Radmin

Radmin is a Remote Access Tool that lets users provide technical support, and conduct their work or perform administrative tasks remotely. While Radmin isn't threatening innately, many threat actors include Radmin as a component for launching backdoor attacks that give them control over your PC or drop other threats. Users should treat unauthorized installations as high-level security risks and uninstall Radmin with appropriate anti-malware tools.

When Administration Comes without Consent

While Radmin is a prominent and legitimate software product that gives users remote-accessibility options for servicing PCs, it's of equal use to threat actors who desire the same degree of control for meeting very different goals. Thanks to its ease-of-use and flexibility, malware researchers can connect the misuse of Radmin to various criminals' campaigns, including attacks from a variant of CoinMiner and the Remote Access Trojan Ghost Radmin. The consequences and negative security implications of the non-consensual use of this software are, accordingly, nearly limitless.

Radmin or Remote Administrator is a product of Famatech LLC for Windows PCs. Threat actors deploy it after cracking a server's login, using a software vulnerability like Exploit.CVE-2014-1761.Gen, or convincing victims into opening an e-mail attachment that delivers a Trojan dropper. With that opening level of access, Radmin broadens the degree of compromise significantly by giving a remote attacker features such as a 'drag and drop' file transferral, unrestricted access to the user interface such as keyboard and mouse input, and the ability to launch files such as installation executables for other programs. It also adds itself to the firewall automatically.

When it's in a corrupted context, Radmin is equivalent to a Remote Access Trojan, but its symptoms depend on how the threat actor uses these capabilities. A criminal may use Radmin for passive surveillance but, also, can drop other threats at will. Most configurations of Radmin involve it hiding its files and processes from the local user for perfecting the stealth aspects of infection.

Booting Out an Admin Your Network Didn't Need

Preventing Radmin attacks requires updating software for patching out vulnerabilities, using passwords that criminals can't brute-force, and avoiding any contact with infection vectors like corrupted torrents or e-mail attachments. Because of how widespread access to illicit versions of Radmin is, malware researchers may not be capable of predicting all of the attack and infection techniques that are in use. However, most infections require some permission or poor security behavior from the victim.

Radmin is many years old, and its potential criminal uses fluctuate with the trends of the Black Hat hacking industry. Some of its particularly recent deployments involve supplemental support by Mimikatz, which collects passwords (usually, for lateral infection throughout a network), and a Monero cryptocurrency-mining Trojan. Professional anti-malware products should detect most of these threats and remove Radmin, etc., during their routine scans.

Radmin, like many programs, is good software that criminals use with not-very-good motives. Users only can do their best at monitoring their network security and making themselves difficult targets for misappropriated software to crack.