Uzakdan girmek trojany (ScreenConnect, AnyDesk, RustDesk, UltraViewer) tehnologiýa goldaw kezzaplygy: ethernet çekmek, hyzmatlary öldürmek we bank doňmagy¶

Aldawçy uzakdaky iş stoly guralyny gurmaga ýa-da kompýuteriňizde uzakdan gözegçilik agentini ýerine ýetirmäge ynandyrsa, syçanjygyňyza, klawiaturaňyza, faýl ulgamyňyza we işjeň brauzer sessiýalaryna göni, çäklendirilmedik gözegçilik edýär. Monitorda galp howpsuzlyk skaneri ýa-da gara gizlinlik perdesi görkezilende, operator hasaplary sessiz-üýnsüz çykarýar, ýatda saklanan parollary ýygnaýar we adaty ýüklemelerden halas bolan yzygiderli fon hyzmatlaryny gurýar. Bu gollanma hüjümçiniň maglumat baglanyşygyny kesmek, gözegçilik edilmedik uzak aralyk hyzmatlaryny hemişelik ýok etmek we sim ulgamyny arassalamazdan ozal bank we karz infrastrukturany ýapmak üçin ädimleri üpjün edýär.

Indi et¶

1. ** Internethli internet birikmesini fiziki we derrew kesiň. Aýyrmak düwmesine basmak üçin syçanjygyň kursoryny dolandyrmak üçin kezzapçy bilen göreşmek üçin wagt ýitirmäň.
2. ** Ekrany öçürilen bolsa, bozulan kompýuteri zor bilen ýapyň. ** Eger hüjümçi "Boş myhman monitory" açan bolsa ýa-da klawiatura girişiňizi gulplasa, enjam doly öçýänçä kompýuteriňiziň fiziki güýç düwmesini 10 sekuntlap ​​basyp saklaň. Maliýe hasaplaryňyzy aýratyn, arassa enjamdan goraýan wagtyňyz ony öçüriň.
3. Call your bank's fraud department from an independent phone. Use a cellular phone to call the official number printed on the back of your debit or credit card, or call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) if an active extortion threat is occurring; see gyssagly kömek belgileri for international contacts. Instruct the bank to place an immediate hard freeze on all checking, savings, and line-of-credit accounts, and demand an emergency recall on any pending Automated Clearing House (ACH), wire, or real-time payment transfers.
4. ** Işjeň sessiýa gutapjyklaryny yzyna alyň we arassa smartfondan parollary üýtgediň. Activehli işjeň giriş sessiýalaryny ýapyň, tanalmaýan köp faktorly tanamak (MFA) enjamlaryny ýatyryň we parollaryňyzy aýlaň.
5. Boot the infected computer into Safe Mode Without Networking. Only turn the compromised computer back on while disconnected from the internet, entering Windows Safe Mode or macOS Safe Mode to inspect and strip out unattended background services (ScreenConnect Client, AnyDesk Service, RustDesk Service) before the operating system loads third-party network drivers.

Understanding the anatomy of a commercial RMM and remote desktop attack¶

Modern technical support scams, refund frauds, and bank impersonation attacks rarely rely on custom-written computer viruses. Instead, threat actors abuse legitimate, digitally signed Remote Monitoring and Management (RMM) software and commercial remote desktop tools. Because these executables carry valid cryptographic code-signing certificates from trusted software vendors, standard antivirus programs like Windows Defender or macOS XProtect do not block their installation.

How attackers weaponize legitimate remote support binaries¶

When a victim calls a toll-free number displayed on a fake browser pop-up, replies to an urgent invoice email, or follows instructions from a fake bank fraud investigator, the operator directs them to download an executable or MSI installer. The most heavily abused platforms include:

• ConnectWise ScreenConnect (formerly Control): Often deployed via a customized .msi ýa-da .exe package hosted on an attacker-controlled server. Once executed, it installs as a persistent Windows System Service (ScreenConnect Client (xxxx)) running with NT AUTHORITY\SYSTEM privileges, granting silent, unattended access whenever the computer is online.
• AnyDesk (anydesk.exe): Frequently used in cross-platform scams targeting Windows, macOS, and mobile devices. Attackers instruct the victim to read aloud the 9-digit AnyDesk address, request administrative elevation, and set an "Unattended Access Password" to reconnect while the victim sleeps.
• RustDesk (rustdesk.exe): An open-source remote desktop tool favored by scam syndicates because they can self-host relay servers, bypassing vendor abuse takedowns.
• UltraViewer, TeamViewer, Zoho Assist, and SimpleHelp: Commonly chained together. A scammer connecting via UltraViewer or AnyDesk will often silently install a hidden ScreenConnect ýa-da SimpleHelp package in the background as a backup backdoor.

Emergency workflow: severing the connection and triaging damage¶

Use the following operational flowchart to stop an active remote session, isolate the workstation, and determine whether the machine can be cleaned in Safe Mode or requires a complete operating system wipe.

flowchart TD
    A["Active or Recent Remote Access Scam Detected"] --> B["Physically Unplug Ethernet Cable and Power Off Wi-Fi Router"]
    B --> C{"Is Screen Blacked Out or Mouse Locked?"}
    C -- "Yes" --> D["Hold PC Physical Power Button for 10 Seconds to Force Off"]
    C -- "No" --> E["Switch Airplane Mode ON and Shut Down PC Normally"]
    D --> F["Use Clean Smartphone on Cellular Data to Call Bank Fraud Dept"]
    E --> F
    F --> G["Freeze Checking/Savings, Recall Wires/Zelle, Lock Credit Bureaus"]
    G --> H["From Clean Smartphone: Rotate Email/Bank Passwords & Kill Sessions"]
    H --> I{"Aldawçy gözegçiliksiz girdimi ýa-da CMD / PowerShell işledimi?"}
    I -- "Hawa (Rokary töwekgelçilik)" --> J["Boot PC Offline into Safe Mode to Rescue Personal Docs Only"]
    I -- "No (Brief Supervised Session)" --> K["Boot Offline into Safe Mode to Purge RMM Services and Certs"]
    J --> L["Perform Full Clean OS Reinstall via USB Media From Clean PC"]
    K --> M["Remove Services, Scheduled Tasks, AppData, and Audit Browser Extensions"]

Comparison of remote access tools abused by scammers¶

Before attempting to clean a machine or report the incident to your bank's forensic fraud team, identify which remote tool(s) were installed. Remember that scammers routinely install two or three different tools during a single session so that if you uninstall the visible desktop icon, their hidden secondary service remains active.

Step-by-step banking and financial triage (First 30 minutes)¶

In a remote access scam, the computer infection is only the delivery mechanism; the primary emergency is acute financial theft. Attackers use psychological and technical tricks, such as editing the HTML source code (Inspect Element) of your bank's webpage to simulate an accidental $40,000 overpayment instead of $400, to trick you into wiring money, buying gift cards, or depositing cash into a Bitcoin ATM. Even if you refused to send money, an attacker with remote access can initiate transfers directly while your screen is blacked out.

1. Place an immediate hard freeze and initiate transfer recalls¶

Call your financial institution's dedicated fraud department immediately using a clean phone. State clearly: "My computer was compromised by a remote access trojan during a tech support/bank impersonation scam. An unauthorized party had live access to my online banking session." Demand the following specific actions:

• Online Banking Profile Lockout: Have the bank disable your online and mobile banking login credentials entirely and invalidate all active OAuth tokens and session cookies.
• ACH, Wire, and RTP Recall (SWIFT / Fedwire / Faster Payments): Ask the representative to inspect your account for any pending or queued outbound Automated Clearing House (ACH) transfers, domestic/international wire transfers, Zelle / Venmo payments, or "Bill Pay" checks scheduled for future dates. Scammers often schedule a Bill Pay check or post-dated ACH transfer set to execute 3 to 5 days later hoping you will not notice.
• Account Number Substitution: Because the attacker likely viewed your full routing and checking account numbers (or downloaded PDF bank statements from your browser), freezing the debit card alone is insufficient. You must request that the bank close the compromised account numbers and transition your balances into brand-new account numbers with "Post No Debits" (PND) restrictions on the old accounts.
• Check for Hidden Internal Transfers or Cash Advances: Attackers frequently take a cash advance from your linked credit card or Home Equity Line of Credit (HELOC) and transfer it into your checking account first, either to make you believe they "accidentally over-refunded" you, or to pool maximum liquidity before wiring the combined balance offshore. Tell the bank fraud specialist to check if any intra-bank transfers occurred between your savings, credit card, or brokerage accounts.

2. Freeze credit bureaus and check for new loan applications¶

While connected to your PC, scammers routinely search your Downloads ýa-da Documents folders for keywords like tax, 1040, W2, passport, license, ýa-da password and exfiltrate your tax returns and ID scans.

1. Place a free Security Freeze at all major credit bureaus immediately using your clean smartphone:
2. In the United States: Freeze Equifax (1-888-298-0045), Experian (1-888-397-3742), TransUnion (1-800-916-8800), and ChexSystems (1-800-428-9687).
3. In the United Kingdom: Contact Experian, Equifax, and TransUnion, and register for Cifas Protective Registration.
4. In Canada: Place credit freezes or fraud alerts with Equifax Canada and TransUnion Canada.
5. In Australia: Request a credit ban through Equifax, Illion, and Experian.
6. Review your credit report immediately for hard inquiries made in the last 24 hours; scammers often apply for instant online personal loans in a background browser tab while talking to you.

Eradicating remote access services in Safe Mode (Windows and macOS)¶

If you decide to inspect the machine, preserve forensic logs for law enforcement, or rescue irreplaceable personal photos before wiping the hard drive, never boot the computer into normal mode while connected to the internet. The moment a normal boot completes with Wi-Fi active, a persistent ScreenConnect ýa-da AnyDesk service will phone home to the scammer's console and alert them that your machine is back online.

Phase 1: Booting into Safe Mode Without Networking¶

Windows 10 we Windows 11-de¶

1. Make sure the Ethernet cable is unplugged and your home Wi-Fi router is unplugged or Airplane Mode is active.
2. Power on the PC. At the Windows sign-in screen, hold down the Left Shift key while clicking Power -> Restart.
3. On the blue recovery screen, select Troubleshoot -> Advanced options -> Startup Settings -> Restart.
4. When the startup options list appears, press 4 or F4 (Enable Safe Mode). Do not press 5 (Safe Mode with Networking).

On macOS (Apple Silicon and Intel)¶

1. Turn off the Mac and turn off your Wi-Fi router.
2. Apple Silicon (M1/M2/M3/M4): Hold the Power button until "Loading startup options" appears. Select your startup disk, hold Shift, and click Continue in Safe Mode.
3. Intel Mac: Turn on the Mac and immediately hold the Shift key until the login window appears.

Phase 2: Hunting and terminating persistent Windows Services¶

Standard uninstallation via "Add or Remove Programs" often fails to remove customized ScreenConnect MSI gurýar, sebäbi hüjümçiler Windows Registrinden aýyrma ýazgysyny aýyrýarlar ýa-da tötänleýin alty belgili hyzmat atlary bilen birnäçe hadysany ýerleşdirýärler.

1. In Windows Safe Mode, press Win + R, ýazyň services.msc, we ** Enter ** basyň.
2. Click the Name column to sort alphabetically, and carefully inspect every service for the following names:
3. ScreenConnect Client (xxxxxxxxxxxxxxxx) (Note: There may be two or three separate ScreenConnect Client entries with different 16-character alphanumeric strings in parentheses, where each represents a different scammer server).
4. AnyDesk Service
5. RustDesk Service
6. UltraViewerService
7. TeamViewer
8. Zoho Assist - Unattended Agent ýa-da SimpleHelp Remote Access
9. For every suspicious service you find, right-click it and select Properties.
10. Read the Path to executable field carefully and write it down (for example, C:\Program Files (x86)\ScreenConnect Client (a1b2c3d4e5f6g7h8)\ScreenConnect.ClientService.exe).
11. Change the Startup type dropdown to Disabled, click Stop (if running), and click Apply and OK.
12. Next, open an elevated Command Prompt (Win + X -> Terminal (Admin) or Command Prompt (Admin)) and permanently delete the service registrations using the exact service name listed in the properties window:

sc stop "AnyDesk"
sc delete "AnyDesk"
sc stop "RustDesk"
sc delete "RustDesk"
sc stop "UltraViewerService"
sc delete "UltraViewerService"

For ScreenConnect, query all installed instances and delete each one by its exact service key name:

sc query state= all | findstr /I "ScreenConnect"
sc delete "ScreenConnect Client (a1b2c3d4e5f6g7h8)"

Phase 3: Purging Scheduled Tasks, Startup folders, and hidden directories¶

Even after a Windows Service is deleted, attackers often configure a scheduled task that re-downloads the remote agent via powershell.exe ýa-da mshta.exe every time a user logs in.

1. Basyň Win + R, ýazyň taskschd.msc, and press Enter to open Task Scheduler.
2. Click Task Scheduler Library in the left pane. Expand every subfolder and inspect the Actions tab of each scheduled task. Delete any task that launches binaries from C:\Users\<User>\AppData\, C:\ProgramData\, or invokes curl, bitsadmin, powershell -WindowStyle Hidden, or any remote desktop executable.
3. Basyň Win + R, ýazyň shell:startup, and press Enter. Delete any shortcuts or .bat / .vbs scripts placed in your user Startup folder. Repeat this by typing shell:common startup to inspect the system-wide Startup folder.
4. Enable viewing hidden files in File Explorer (View -> Show -> Hidden items) and manually delete the application directories and configuration caches for all remote tools:
5. C:\Program Files (x86)\ScreenConnect Client (*)
6. C:\ProgramData\ScreenConnect Client (*)
7. C:\Program Files (x86)\AnyDesk\ we C:\ProgramData\AnyDesk\
8. C:\Users\<YourUsername>\AppData\Roaming\AnyDesk\
9. C:\Program Files\RustDesk\ we C:\Users\<YourUsername>\AppData\Roaming\RustDesk\
10. C:\Program Files (x86)\UltraViewer\ we C:\Users\<YourUsername>\AppData\Roaming\UltraViewer\

Phase 4: Removing macOS LaunchDaemons, LaunchAgents, and Privacy Grants¶

On macOS, remote access tools establish persistence through LaunchDaemons (system-wide) and LaunchAgents (user-level), combined with macOS TCC (Transparency, Consent, and Control) permissions for Screen Recording and Accessibility.

1. While in macOS Safe Mode (offline), open Finder, press Cmd + Shift + G (Go to Folder), and inspect the following three directories one by one:
2. /Library/LaunchDaemons/
3. /Library/LaunchAgents/
4. /Users/<YourUsername>/Library/LaunchAgents/
5. Drag any .plist files containing connectwise, screenconnect, anydesk, rustdesk, teamviewer, zoho, ýa-da simplehelp to the Trash.
6. Next, open /Applications/ we /Library/Application Support/ and move any corresponding remote access app bundles and support folders to the Trash.
7. Open System Settings -> Privacy & Security. Check two critical sections:
8. Screen & System Audio Recording: Select any remote support tool listed and click the minus (-) button to revoke its ability to view your display.
9. Accessibility: Select any remote support tool and click the minus (-) button to revoke its ability to control your mouse cursor and synthesize keystrokes.
10. Full Disk Access: Verify that no unknown application or terminal wrapper has been granted Full Disk Access.

Reversing Windows password locks and fake boot banners¶

Before disconnecting, vindictive scammers frequently lock victims out of their computers and demand a ransom for the password. They use three primary methods:

1. Changing your local Windows password (net user) or adding a rogue admin account¶

While their screen curtain is active, scammers often open an elevated Command Prompt and run net user <YourUsername> <NewPassword> or create a backdoor administrator account (net user SupportAdmin Pass123 /add && net localgroup administrators SupportAdmin /add). * How to check and fix: In Safe Mode, open an elevated Command Prompt (cmd.exe as Administrator) and type net user. If you see an unfamiliar account, delete it immediately with net user <RogueAccountName> /delete. If your local password was changed, boot from a Windows Installation USB into the Windows Recovery Environment (WinRE) to restore a prior System Restore Point, or sign in with your linked Microsoft Account after resetting your password on a clean smartphone.

2. Enabling a startup message banner via Registry (LegalNoticeCaption)¶

Scammers often modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by setting LegalNoticeCaption we LegalNoticeText to display a fake Microsoft Security lockout phone number before login. * How to fix: This is purely a cosmetic text screen before the normal Windows login prompt. Click OK or press Enter to bypass it, open regedit in Safe Mode, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, and clear the text inside LegalNoticeCaption we LegalNoticeText.

3. Safe Boot PIN lockouts (bcdedit)¶

Microsoft removed the legacy syskey.exe tool in Windows 10 version 1709. Today, scammers instead tick Safe boot inside msconfig and reboot your PC offline. Because Windows Hello PINs often fail on the Safe Mode login screen without network access, victims get trapped in a boot loop. * How to fix: Hold Shift + Restart at the login screen, select Troubleshoot -> Advanced options -> Command Prompt, and run:

bcdedit /deletevalue {current} safeboot

Restart the computer normally (keeping your internet router unplugged) so you can log in with your cached password or PIN and remove the remote software.

Why browser session theft and infostealers require a full OS wipe¶

Even if you delete the ScreenConnect, AnyDesk, ýa-da RustDesk services in Safe Mode, you must evaluate whether the scammer deployed a secondary Infostealer (Lumma, RedLine, Vidar, Stealc) or copied your browser profile directory.

During an unattended remote session, it takes less than 8 seconds for an attacker to run a PowerShell script that copies your Google Chrome, Microsoft Edge, or Brave user data directory (C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\) along with the local DPAPI master decryption key. With those files on their server, the attacker possesses:

1. Every password saved in your web browser's built-in password manager.
2. Active session cookies (Cookies we Network\Cookies SQLite databases): Even if your email or bank uses two-factor authentication (2FA), şifrlenen sessiýa belligi gutapjygyna eýe bolmak, hüjümçä brauzer profiliňizi öz enjamynda antidetekt brauzerine import etmäge we parol gerek bolmazdan Gmail, Outlook, Amazon ýa-da cryptocurrency alyş-çalyş hasabyňyza girmäge mümkinçilik berýär 2FA kody
3. ** Brauzer esasly cryptocurrency gapjyk kassalary (MetaMask, Phantom, Rabby):** Encrypted vault files inside Local Extension Settings are exfiltrated for offline brute-forcing.

When you must perform a clean USB operating system reinstall¶

While Safe Mode service removal is sufficient if you caught the scammer within 10 seconds of installing AnyDesk and never gave them Administrator elevation or unattended access, you must wipe the drive and perform a clean OS installation from a USB stick if any of the following occurred:

• Your screen went black (Blank Guest Monitor) or your mouse/keyboard was locked.
• You saw a Command Prompt (cmd.exe) or PowerShell window flash on the screen.
• You left the computer unattended while the scammer ran a fake security scan.
• You installed ConnectWise ScreenConnect (which runs as SYSTEM by default and allows invisible background shell script execution).

To perform a safe reinstall: 1. While offline in Safe Mode, plug a brand-new USB flash drive into the compromised PC and copy only personal data files (.jpg, .pdf, .docx, .xlsx, family videos). Never copy .exe, .msi, .bat, .ps1, or browser profile folders. 2. Using a different, clean computer, download the official Windows Media Creation Tool from Microsoft (microsoft.com/software-download) or create a bootable macOS installer. 3. Boot the compromised PC from the clean USB installer, delete all existing partitions on the primary drive (Drive 0), and install a fresh copy of the operating system.

Preserving your legal right to bank reimbursement¶

Banks frequently attempt to deny fraud reimbursement claims in remote access scams by arguing that because you clicked "Download" on AnyDesk or ScreenConnect, you "authorized" the transactions or acted with gross negligence. Knowing how statutory consumer banking protections work in your jurisdiction is critical when speaking to your bank's fraud claim adjudicator.

In the United States: Electronic Fund Transfer Act (EFTA) we Regulation E (12 CFR § 1005)¶

Under the federal Electronic Fund Transfer Act (Regulation E), the Consumer Financial Protection Bureau (CFPB) has issued official supervisory guidance stating that: * Induced access is still an "Unauthorized Electronic Fund Transfer": Under 12 CFR § 1005.2(m), an electronic fund transfer initiated by a person who obtained access to a consumer's account through fraud or robbery is defined by law as an unauthorized EFT, even if the consumer was tricked into providing a password, a one-time passcode, or installing remote desktop software. * Negligence cannot be used to deny your claim: The CFPB's Official Interpretation of Regulation E (Comment 6(b)-2) states that consumer negligence (such as falling for a phishing pop-up or granting remote desktop access to a scammer) cannot be used by a bank to impose greater liability on the consumer than Regulation E allows ($50 maximum if reported within 2 business days; $500 maximum within 60 days). * Distinguish between Scammer-Clicked vs. Consumer-Clicked transfers: If the scammer moved the mouse and clicked "Send" behind a black screen during the AnyDesk/ScreenConnect session, it is an Unauthorized EFT covered by Regulation E. Tell the bank in writing: "I did not initiate, authorize, or click the button for this transfer; a criminal threat actor executed the transfer remotely using a Remote Access Trojan while locking my screen, which constitutes an unauthorized EFT under 12 CFR § 1005.2(m)." Attach your preserved connection_trace.txt log or Windows Event Viewer Service Control Manager logs (Event ID 7045 showing the exact minute the ScreenConnect ýa-da AnyDesk service was installed) as forensic proof.

In the United Kingdom, European Union, Canada, and Australia¶

• ** Angliýa (PSR & FOS):** If the scammer controlled your computer directly to move funds, report it as an Unauthorized Payment under the Payment Services Regulations 2017. If the scammer manipulated your screen (Inspect Element fake refund) to trick you into authorizing a Faster Payment yourself, report it under the Payment Services Regulator's (PSR) mandatory Authorized Push Payment (APP) Fraud reimbursement rules and escalate any denial to the **Financial Ombudsman Service (FOS) **.
• European Union, Canada, and Australia: Report the incident immediately to your bank and national police, emphasizing that a remote access trojan executed or manipulated the session. Escalate unresolved bank disputes to the Ombudsman for Banking Services and Investments (OBSI) in Canada or the Australian Financial Complaints Authority (AFCA) in Australia under the ePayments Code.

Post-incident remediation and reporting checklist¶

Complete every item in this checklist before reconnecting your home network or resuming normal online banking:

• Physical isolation confirmed: Compromised computer was physically disconnected from Ethernet and Wi-Fi before any further troubleshooting.
• Bank accounts frozen and re-numbered: All checking, savings, and HELOC account numbers that were visible on the computer have been closed and re-issued with new account numbers.
• Scheduled Bill Pay and ACH queues purged: Verified with a bank supervisor that no future-dated Bill Pay checks, external bank links (Plaid), or standing wire instructions were added during the remote session.
• Credit freezes active: Security freezes placed with Equifax, Experian, TransUnion, and ChexSystems.
• Email forwarding rules audited: Logged into Gmail/Outlook/Yahoo from a clean smartphone and checked Settings -> Forwarding and POP/IMAP and Rules / Filters for hidden rules that auto-delete or forward emails containing "Bank", "Fraud", "Wire", ýa-da "Security Alert".
• Browser password vault rotated: Every password stored inside Chrome, Edge, Firefox, or Safari password managers has been changed from a clean device.
• Forensic logs saved and official reports filed: File reports with the FBI IC3 (ic3.gov) and FTC (reportfraud.ftc.gov) in the US, Action Fraud (actionfraud.police.uk) in the UK, the Canadian Anti-Fraud Centre, or Scamwatch (scamwatch.gov.au) in Australia. Also report the installer binary or connection ID to connectwise.com/company/trust/report-abuse ýa-da anydesk.com/en/abuse.

Freygy-ýygydan berilýän soraglar¶

The scammer showed me my Windows Event Viewer and netstat Command Prompt-da müňlerçe duýduryşlardan, ýalňyşlyklardan we "DAŞARY ADRESS" baglanyşyklaryndan doly. Kompýuterime jaň etmezden ozal döwüldimi?¶

No.ok. Ikisem `eventvwr` (Windows Waka Görkezijisi) we `netstat` Windows-yň her bir nusgasynda gurlan adaty administratiw kömekçi enjamlar we aldawçylar olary psihologiki teklip hökmünde ulanýarlar. Her sagdyn Windows kompýuterinde adaty ýüklemeler we fon täzelenmeleri wagtynda Waka Görkezijisinde müňlerçe yzygiderli sary duýduryş we gyzyl säwlik ýazgylary döredilýär we `netstat` brauzeriňiziň we operasiýa ulgamyňyzyň “Daşary ýurt salgysy” hökmünde bulut serwerlerine edýän her bir adaty fon baglanyşygyny görkezýär. Uzakdan giriş guralyny göçürip almak we işletmek üçin jaň edijiniň görkezmelerini ýerine ýetirýänçäňiz, kompýuteriňiz doly howpsuzdy.

Aldawçy hakyky bank web sahypamy nädip tötänleýin goýandygyny görkezdi $40,000 bankyň serwerini döwüp bilmeýän bolsalar, meniň hasabymda?¶

“AnyDesk” ýa-da “ScreenConnect” arkaly kompýuteriňize birikdirilende, aldawçy ekrany 15 sekuntlap öçürýär, web brauzeriňizdäki bank balansyna sag basyň we ** “Barlamak” düwmesine basyň (`Developer Tools`) **. Bu, brauzer goýmasynda görkezilen ýerli HTML tekstini açýar. Aldawçy diňe ýazýar `$45,200.00` hakyky `$5,200.00` deňagramlaşdyryp, galp tekst setirini okaýar `"ACH REFUND OVERPAYMENT +$40,000.00"` ekranyňyzda. Bu üýtgetme diňe brauzer goýmanyň wagtlaýyn ýadynyň içinde bar (`DOM`) we sahypany täzelän bada-bat ýitýär (`F5`) ýa-da smartfon programmaňyzdaky balansyňyzy barlaň. Ativea-da bolmasa, geçirýärler `$40,000` öz tygşytlylyk hasabyňyzdan ýa-da karz setiriňizden hasabyňyza girip, öz puluňyzy olara aldamak üçin ekrany täzeden işlediň.

Dolandyryş panelinden AnyDesk ýa-da UltraViewer-i aýyrsam, Wi-Fi-ymy açyp bilerinmi?¶

Adatça Windows Hyzmatlaryny barlamazdan (`services.msc`ilki bilen Howpsuz tertipde. Professional tehnologiýa goldaw aldaw jaň merkezleri, pidalaryň asylgy dessine AnyDesk ýa-da UltraViewer-i aýyrýandygyny bilýär. Şonuň üçin kompýuteriňize birikdirilenden ilkinji iki minutyň içinde aldawçylar ikinji derejeli, gizlenen ** ConnectWise ScreenConnect ** düşürmek üçin sessiz faýl geçirişini yzygiderli ulanýarlar (`ScreenConnect.ClientService.exe`) ýa-da iş stolunyň gysga ýoluny döretmeýän we içerde gizlenýän SimpleHelp ** agenti `C:\Program Files (x86)\ScreenConnect Client (xxxx)`. Ygtybarly tertipde tassyklamasaňyz, gödek däl `SYSTEM` hyzmatlar ýa-da meýilleşdirilen meseleler bar, ýa-da doly USB OS süpürgiçini ýerine ýetiriň, Wi-Fi-a gaýtadan birikmek derrew kompýuteriňiziň gözegçiligini hüjümçä tabşyryp biler.

Aldawçy, diňe bir noutbuga AnyDesk guranym üçin öý Wi-Fi ulgamymdaky beýleki kompýuterlere ýa-da smartfonlara girip bilermi?¶

“AnyDesk” ýa-da “ScreenConnect” -i gurmak, telefonlaryňyzy ýa-da beýleki noutbuklaryňyzy gönüden-göni däl-de, gurnaýjyny işleden anyk kompýuteriňize zyýan berýär. Şeýle-de bolsa, noutbukyňyzda we smartfonyňyzda ** Google Chrome, Microsoft Edge ýa-da Apple iCloud paroly we sessiýa sinhronlamak ** ulansaňyz, kezzap ogurlanan ýa-da ýokaşan noutbukdaky üýtgeşmeler umumy bulut hasaplaryňyza täsir eder. Şeýle hem, noutbuk bilen birikdirilende, hüjümçi öý marşrutizatoryňyzyň administrator sahypasyna girip biler (`192.168.1.1`) henizem adaty administrator parolyny ulanýan bolsa we marşrutizatoryňyzy üýtgedýän bolsa `DNS` settings. After isolating the infected laptop, factory-reset your Wi-Fi router or verify its DNS settings and admin password from a clean device.

Degişli gollanmalar¶

• Tehniki çykýan aldaw we uzakdaky iş stoly AnyDesk / TeamViewer aýyrmagy goldaýar
• Session cookie hijacking, infostealer malware, and passkey revocation
• Akeasama CAPTCHA ClickFix PowerShell "Win + R" paneli zyýanly programma üpjünçiligi we Lumma Infostealer düzediş
• Authorized push payment (APP) app fraud: Zelle, Venmo, and Faster Payments impersonation and reimbursement rights
• Bank account breach
• Countryurt boýunça gyssagly kömek belgileri

Çeşmeler we resmi görkezmeler¶

• Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), & Multi-State Information Sharing and Analysis Center (MS-ISAC) (United States): Joint Cybersecurity Advisory (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management (RMM) Software.
• Sarp edijiniň maliýe goragy býurosy (CFPB) (United States): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) Official Interpretations and FAQs on Unauthorized EFTs and Fraudulently Induced Access.
• Federal Trade Commission (FTC) (United States): How To Spot, Avoid, and Report Tech Support Scams.
• Milli kiberhowpsuzlyk merkezi (NCSC) & Action Fraud (United Kingdom): Protecting Devices from Unauthorised Remote Access Tools and Screen-Sharing Fraud.
• ConnectWise Trust & Security Response Center: Identifying and Removing Rogue ScreenConnect (ConnectWise Control) Client Instances.