{
  "family": "teamviewer",
  "sample_count": 1,
  "category": "backdoor",
  "description": "<h3>Executive Summary</h3>\nTeamViewer is a fully legitimate, commercially available remote access and support application. However, in the context of cybersecurity, a \"TeamViewer\" detection (often flagged as Riskware or HackTool) indicates the unauthorized, malicious installation or abuse of this legitimate tool by threat actors. Attackers frequently deploy TeamViewer during targeted intrusions to maintain persistent, interactive remote access to a compromised environment while completely bypassing traditional malware signatures, a tactic known as \"Living off the Land.\"\n\n<h3>Exploitation and Abuse Mechanics</h3>\nBecause TeamViewer is a signed, trusted application, it easily bypasses standard antivirus scanning. Threat actors abuse it in the following ways:\n<ul>\n<li><strong>Silent Installation:</strong> After gaining initial access (via phishing, RDP brute-forcing, or a prior malware infection), attackers often download a portable or customized version of TeamViewer. They execute it silently from the command line, suppressing the graphical user interface so the victim is unaware it is running.</li>\n<li><strong>Persistence and C2:</strong> The attacker configures TeamViewer to start automatically with Windows and sets a static, complex password for \"Unattended Access.\" This provides the attacker with a highly stable, encrypted command-and-control (C2) channel directly into the victim's desktop, utilizing TeamViewer's legitimate servers to route the traffic, easily bypassing edge firewalls.</li>\n<li><strong>Data Exfiltration and Lateral Movement:</strong> Once connected via TeamViewer, the attacker has full GUI access. They can use the built-in file transfer capabilities to exfiltrate sensitive data or execute tools to pivot laterally across the network.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe unauthorized presence of TeamViewer is a critical security incident. It indicates that an attacker has established a highly reliable backdoor into the environment. Because the tool operates over standard HTTPS ports and utilizes legitimate infrastructure, detecting the malicious activity requires advanced behavioral monitoring.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for the unexpected execution of `teamviewer.exe`, especially when launched from temporary directories or with command-line flags suppressing the UI (e.g., `--silent`).</li>\n<li><strong>Network Isolation:</strong> Immediately isolate any endpoint found running an unauthorized instance of TeamViewer.</li>\n<li><strong>Application Control (Whitelisting):</strong> Enforce strict application whitelisting. If TeamViewer is not the officially sanctioned remote support tool for the enterprise, its execution should be explicitly blocked globally via AppLocker or EDR policies.</li>\n<li><strong>Forensic Review:</strong> Investigate the endpoint to determine *how* TeamViewer was installed, as this indicates a prior, deeper compromise.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Riskware.TeamViewer",
    "Tool.TeamViewer",
    "RemoteAccess.TeamViewer"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1219",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:48:23Z",
  "type": "Riskware / Legitimate Tool Abused",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}