Researchers from ANY.RUN have identified a Remote Monitoring and Management (RMM) phishing campaign operating across 46 countries. While the campaign initially appeared Canada-focused due to the use of Canada Revenue Agency (CRA) tax forms as lures, analysis revealed the United States as the primary target, accounting for roughly 45% of the approximately 601 observed cases. The operation leverages RMM tools as a delivery mechanism for phishing emails designed to mimic legitimate tax or financial notifications.

What should defenders do?

Users should exercise caution with unsolicited tax-related or financial documents. Verify sender authenticity before interacting with attachments or links. Implement email filtering to block known lure subjects and domains. Educate employees on recognizing phishing attempts that mimic legitimate tax authorities or financial institutions.

highCyber Attacks

US Leads Global Targets in RMM Phishing Campaign Spanning 46 Countries

Approximately 601 cases observed; 45% of activity concentrated on United States, researchers say

CyberIntel DeskPublished 25 days agoUpdated less than a minute ago1 min read

US Leads Global Targets in RMM Phishing Campaign Spanning 46 Countries

Key Takeaways

RMM phishing campaign active in 46 countries globally.
United States is the primary target, representing approximately 45% of observed cases.
Around 601 cases have been connected to the operation by ANY.RUN researchers.
Phishing emails use Canada Revenue Agency (CRA) tax form lures, indicating localized targeting within a global framework.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read