Why do threat groups abuse legitimate Remote Monitoring and Management (RMM) tools?

Threat groups abuse commercial RMM tools like AteraAgent and Splashtop because they are legitimate administration programs. By utilizing these tools, attackers can establish persistent remote access that is frequently whitelisted by standard antivirus and EDR solutions, avoiding security alarms.

PEAR Team Leaks 1.8 TB of Exchange Group Databases | Femto Security Threat Intelligence

Key Takeaways

The PEAR Team allegedly exfiltrated and leaked 1.8 TB of highly sensitive corporate databases, QuickBooks/Sage financial files, and HR records belonging to Exchange Group.
The group targets compromised remote access credentials, utilizing long dwell times to thoroughly map target networks and isolate valuable database repositories.
Rather than encrypting targets, PEAR utilizes an exfiltration-only extortion model, exploiting legitimate RMM utilities like AteraAgent and Splashtop to maintain persistence undetected.

Original source screenshot for PEAR Team Leaks 1.8 TB of Exchange Group Databases — Original source screenshot - darkforums.su

PEAR Team Attack Metrics

Exfiltrated Data

0 TB

Minimum Network Dwell

0 Days

Maximum Network Dwell

0 Days

Threat Actor Profile: PEAR Team

PEAR (Pure Extraction and Ransom) Team

aka PEAR Team

Origin: Unknown
Motivation: Financial Extortion (Exfiltration-only)
Targets: Financial ServicesAccounting & ConsultingProfessional ServicesHealthcare
TTPs: Compromised VPN/RDP AccessLegitimate RMM Abuse (Atera, Splashtop)Living off the Land (PowerShell, PsExec)Data-only extortion (no encryption)Staging via RClone/WinSCP

PEAR Team Intrusion and Extortion Lifecycle

1Initial Accessmedium
Valid VPN/RDP Credentials
medium
2Persistencehigh
Malicious RMM (Atera/Splashtop)
high
3Discoverymedium
Target Sage/QuickBooks
medium
4Exfiltrationhigh
Renamed RClone/WinSCP
high
5Extortioncritical
Tor Leak Site Staging
critical

Observed MITRE ATT&CK Techniques

Initial Access

T1078

Valid Accounts

T1566

Phishing

Execution

T1059.001

PowerShell

Persistence

T1219

Remote Access Software

Defense Evasion

T1036

Masquerading

Credential Access

T1003

OS Credential Dumping

Collection

T1005

Data from Local System

Exfiltration

T1567.002

Exfiltration to Cloud

PEAR Team Indicators of Compromise (IoCs)

email
[email protected]
Extortion Contact Email
email
[email protected]
Extortion Contact Email
domain
peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion
Tor Leak Site
domain
peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion
Tor Leak Site
domain
pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onion
Tor Leak Site
domain
pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onion
Tor Leak Site
domain
diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd.onion
Tor Leak Site
domain
diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd.onion
Tor Leak Site
hash
457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18DDDFF71909ED
Tox ID
hash
457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18DDDFF71909ED
Tox ID
cve
CVE-2024-40766
Often leveraged historically by access brokers (SonicWall)
cve
CVE-2024-40766
Often leveraged historically by access brokers (SonicWall)

Immediate Mitigation Actions

Progress0 / 5 (0%)

Revoke and Reset Active Directory, VPN, and RDP Credentials
Force system-wide password reset and terminate all active sessions.
Enforce Multi-Factor Authentication
Prioritize phishing-resistant methods on all external & admin interfaces.
Audit RMM Solutions
Identify and block unapproved instances of Atera, Splashtop, AnyDesk.
Isolate Affected Hosts
Quarantine suspicious servers/workstations using EDR network isolation.
Validate and Secure Immutable Backups
Ensure backup systems are network-isolated and in WORM configuration.

How to Defend Against Similar Threats

Audit all endpoints for unauthorized RMM installations, specifically AteraAgent, Splashtop, and AnyDesk.
Implement strict multi-factor authentication (MFA) requirements across all active VPN, RDP, and cloud services.
Deploy behavioral detection logic to identify anomalies in file compilation, staging, and data exfiltration utilizing command-line sync utilities.

Threat Intel FAQ

What is the PEAR Team and how do they operate?

The PEAR (Pure Extraction and Ransom) Team is an emerging cyber-extortion group active since mid-2025. Unlike typical ransomware gangs, they primarily employ an exfiltration-only (non-encryption) business model, exfiltrating large amounts of sensitive data and threatening public release to force ransom payments.

How did the PEAR Team gain access to Exchange Group?

The threat actors primarily rely on compromised VPN or remote desktop protocol (RDP) credentials. These stolen credentials are often obtained from historical third-party data breaches, credential stuffing campaigns, or direct acquisitions from dark web infostealer logs.

Could a similar threat affect your organization?

If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.