{
  "family": "ammyy",
  "sample_count": 2,
  "category": "ransomware",
  "description": "RemoteAccess:Win32/Ammyy (Ammyy Admin) is a completely legitimate, commercially available Remote Desktop software tool. However, because it is free, portable (requires no installation), and easily bypasses NAT and firewalls, it is extensively abused by cybercriminals. It is a primary tool used by Tech Support Scammers and Initial Access Brokers (IABs) to establish interactive control over a compromised system (`T1219`).<br><br><b>Understanding Ammyy (Abused Legitimate Tools)</b><br>To an end-user, Ammyy Admin might look like a helpful support tool they were instructed to run by a 'technician' over the phone. For a Security Operations Center (SOC), the unauthorized execution of Ammyy Admin is a critical incident. Because the binary is digitally signed and technically benign, traditional antivirus will often not block its execution, making it a powerful 'Living off the Land' technique.<br><br><b>Execution and Abuse Mechanics</b><br>Attackers typically use social engineering (`T1566.002`) to convince a victim to navigate to the Ammyy website, download the portable executable (`AA_v3.exe`), and provide the attacker with the generated 'ID' and 'Password'. Once connected, the attacker has full GUI access to the desktop, exactly as if they were sitting at the keyboard. They use this access to disable antivirus (`T1562.001`), steal files (`T1005`), or manually download and execute ransomware (`T1105`). Advanced threat actors may drop Ammyy Admin via a secondary dropper to use as a backup backdoor if their primary C2 channel is discovered.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system control to an interactive attacker. Host-based IoCs include the presence of the `AA_v3.exe` (or similar variants) binary, often dropped in the `Downloads` or `%Temp%` folder. Network IoCs include outbound connections to Ammyy's legitimate routing servers (`router.ammyy.com`), which are often categorized as 'Remote Access' by firewalls but not necessarily blocked by default.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1219",
    "T1105",
    "T1566.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Abusing a legitimate tool for malicious interactive access)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Social engineering to force the user to download the tool)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Using the Ammyy file manager to drop ransomware)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Terminate the Ammyy Admin process immediately and isolate the machine to cut off the attacker's interactive session.",
    "If the user was socially engineered into installing it, assume all credentials typed on that machine are compromised and reset them.",
    "Block access to `ammyy.com` and its associated routing IPs at the enterprise perimeter firewall/proxy.",
    "Use EDR to hunt for instances of `AA_*.exe` across the entire environment to ensure it hasn't been deployed laterally."
  ],
  "what_to_avoid": [
    "Do not whitelist Ammyy Admin in your EDR/AV simply because it is a 'legitimate' tool; unless it is officially sanctioned by your IT department, it should be blocked.",
    "Avoid leaving the machine on the network while investigating, as the attacker has live, interactive control."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}