Kickidler employee monitoring software abused in ransomware attacks
Legitimate Kickidler employee monitoring software is being used by ransomware operations for reconnaissance, activity tracking, and credential harvesting following network breaches.
Qilin and Hunters International ransomware affiliates installed Kickidler, an employee monitoring application that can record keystrokes, take screenshots, and record screen movies, during attacks seen by cybersecurity firms Varonis and Synacktiv.
According to Kickidler's developer, the application offers visual monitoring and data loss protection tools and is utilized by more than 5,000 enterprises across 60 countries.
When customers searched for RVTools, a free Windows tool for managing VMware vSphere deployments, the threat actors first removed the Google Ads that appeared. When the advertisement w...