Skip to content
Threat Feed
Subscribe

Vendor

Nezha

2 briefs RSS
medium advisory

Suspicious Activity: Multiple Remote Management Tool Vendors on Same Host

This brief describes a behavioral detection for Windows hosts where two or more distinct remote monitoring and management (RMM) or remote-access tools from different vendors are observed starting processes within an eight-minute window, indicating potential compromise, shadow IT, or attacker staging of redundant access.

Acronis Cyber Protect Connect +49 command-and-control remote-access-software rmm windows behavioral-detection
1t
critical advisory

Nezha Monitoring Cross-Tenant RCE via Cron Task Injection

A RoleMember in Nezha monitoring dashboard can achieve cross-tenant remote code execution by injecting arbitrary commands into cron tasks due to insufficient authorization checks, impacting all monitored hosts in the deployment.

nezha rce privilege-escalation cron authorization
3r 3t