Hackers Are Using Your IT Department's Tools Against You
Attackers are installing legitimate remote access software to maintain secret access to business computers. Here's how to spot the warning signs.
Source
GetCyberRight Intelligence
Original headline: Attacker Uses Legit Tools as Backup Access
Plain-English summary by GetCyberRight. Read the full report at the source above.
What Happened
A hacker recently broke into a French business and did something clever: he installed legitimate IT support tools like OpenSSH and Tailscale as backup access points. When his main attack system failed, these trusted tools kept working, giving him continued secret access to the company's network. This matters because these programs look exactly like software your IT team might use, making them nearly impossible to detect.
The Details
Think of this attack like a burglar who doesn't just pick your lock. He also makes a copy of your key and hides a spare under the doormat. The hacker started with a traditional attack: he planted a keylogger and stole passwords. Nothing groundbreaking there.
But then he installed two legitimate remote access tools. OpenSSH is software that lets technicians connect to computers remotely. Tailscale is a newer tool that creates secure network connections. Both are used by IT professionals every day. That's exactly why they work so well for attackers.
When the hacker's main command server went offline (which happens often when security teams or hosting providers shut down malicious infrastructure), he didn't lose access. He simply connected through these backup tools instead. To anyone monitoring the network, the traffic looked completely normal. It appeared to be routine IT maintenance, not an active break-in.
Who Is Affected
Small business owners and managers should pay close attention to this threat. Your company likely doesn't have a dedicated security team watching every software installation. You might have one IT person or use outside contractors. That makes it harder to notice when unauthorized remote access tools appear on employee computers.
Remote workers face particular risk. When employees work from home, business owners have less visibility into what's installed on work devices. An attacker could install these tools on a laptop, and nobody would notice until something goes wrong. By then, sensitive data may already be stolen.
What You Should Do Right Now
Audit every computer in your business. Check what remote access software is installed. Look specifically for Tailscale, TeamViewer, AnyDesk, OpenSSH, and similar tools. Write down what you find.
Stay one step ahead of scammers
Weekly cybersecurity briefings for families. No spam, just the threats that matter and what to do about them.
Verify every remote access tool with your IT person or provider. Ask: Did you install this? Do we need it? When was it last used? If they didn't install it, disconnect that computer from your network immediately.
Create a policy that requires approval before installing remote access software. No employee should install these tools without written permission from management. Make this a clear company rule.
Review your firewall and network logs if you have them. Look for unusual outbound connections, especially to services your business doesn't use. Your IT provider can help with this.
Train your employees to recognize social engineering attacks. Many breaches start with phishing emails or fake tech support calls. Education is your first line of defense.
The Bigger Picture
Attackers are getting smarter about blending in. They're using the same tools that legitimate businesses use, making detection much harder. This trend means small businesses can't rely on basic antivirus software alone. You need awareness, policies, and regular audits. Staying informed about these evolving tactics isn't optional anymore. It's a core business responsibility.
How GetCyberRight Can Help
Our Training Academy provides security awareness training designed specifically for small businesses. You'll learn to recognize advanced persistence techniques like this one, train your employees to spot warning signs, and build practical security policies that actually work. The course explains complex attacks in plain language and gives you actionable steps to protect your business without needing a technical degree.
Curated from trusted cybersecurity sources by GetCyberRight
Source: GetCyberRight IntelligenceStay ahead of cyber threats
Get our free weekly digest. Real threats, plain language, what to do about them. No spam, ever.
More articles
Get a Free Cybersecurity Certification This Summer (Worth $600+)
ISC2 is offering free professional cybersecurity training and certification this summer, creating an accessible pathway into tech careers for anyone.
3 min readYour Phone Is Broadcasting Your Location: Here's How to Stop It
Smartphones track your family's location through multiple hidden methods. Learn which apps are watching you and how to take back control right now.
3 min read
Hospital Worker Accessed Royal Medical Records: What Families Should Know
A hospital employee faces prosecution for viewing the Princess of Wales's private medical records. This insider threat exposes privacy risks in every healthcare system.
3 min readMFA Isn't Enough Anymore: What Families Need to Know About Modern Attacks
Attackers have learned to bypass multi-factor authentication. A new webinar explains how these tactics work and what actually protects your accounts now.
3 min read