[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFVAJwR6o3fVXaGT6GbLNVU8H_Xt7czZvofhOZzqT-2Q":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"33b574b2-66c7-4499-826a-bdb3e7cc0850","Hackers Abuse Legitimate IT Management Tool to Sneak Into Business Networks","hackers-abuse-legitimate-it-management-tool-to-sneak-into-business-networks-3e2d5a","Cybersecurity researchers at Huntress have uncovered a phishing campaign that abuses Faronics Deploy, a legitimate endpoint management platform used by businesses, schools, and government offices to remotely install software and run scripts across their networks. According to the security firm, threat actors sent victims phishing emails disguised as invoices, tax documents, financial records, and event […] The post Hackers Abuse Legitimate IT Management Tool to Sneak Into Business Networks appeared first on IT Security Guru.","Huntress researchers have identified a phishing campaign that leverages Faronics Deploy, a legitimate remote software installation and scripting tool. Threat actors are sending malicious emails disguised as common business documents to trick recipients into executing the tool, thereby gaining unauthorized access to corporate networks.","Hackers are using Faronics Deploy, a legitimate IT management tool, to gain unauthorized access to business networks.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F02\u002Fhackers-abuse-legitimate-it-management-tool-to-sneak-into-business-networks\u002F?utm_source=rss&utm_medium=rss&utm_campaign=hackers-abuse-legitimate-it-management-tool-to-sneak-into-business-networks",null,"2026-09-02T10:48:54+00:00","2026-09-02T18:00:21.857496+00:00",7,[17,20],{"name":18,"type":19},"Faronics Deploy","product",{"name":21,"type":22},"Huntress","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":12,"name":25,"slug":26},"Malware","malware",[28,33,35],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":43,"vendors":125},[44,70,99],{"slug":45,"name":46,"problem":47,"products":48},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":66,"product_name":67,"url":68,"description":69},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":71,"name":72,"problem":73,"products":74},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":100,"name":101,"problem":102,"products":103},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[104,111,118],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":105,"product_name":108,"url":109,"description":110},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":112,"vendor_name":21,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":100,"product_name":122,"url":123,"description":124},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[126],{"slug":112,"name":21,"logo_path":113,"roles":127},[128],"reported_by",{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":146},"phishing-campaign-weaponizes-legitimate-it-tool-to-infiltrate-corporate-networks","Phishing Campaign Weaponizes Legitimate IT Tool to Infiltrate Corporate Networks","Threat actors exploited the inherent trust users place in legitimate IT management software (Faronics Deploy) by delivering it via phishing emails disguised as routine business documents. This 'living-off-the-land' technique is particularly dangerous because the tool itself is not malicious, allowing it to bypass many traditional security controls that rely on signature-based detection. Once executed by an unsuspecting employee, attackers gain a fully functional remote access foothold inside the corporate network. This highlights how human error, combined with insufficient application whitelisting and monitoring, creates significant exposure even when no malware is directly deployed. Organizations must recognize that legitimate tools can be just as dangerous as malware when misused by adversaries.",[134,135,136,137,138,139,140,141,142,143,144,145],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-1 – Network Communications Monitoring","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1219 – Remote Access Software","GDPR Article 32 – Security of Processing (organizational measures)",{}]