Date: 11/02/2026
Severity: High
Summary
The team has recently identified multiple incidents in which threat actors abused mobile device management (MDM) applications to conduct malicious activities. Rather than exploiting software vulnerabilities, attackers misused legitimate MDM tools to gain access to managed devices. Organizations use these platforms to remotely enroll, configure, and manage employee laptops, smartphones, and other endpoints. MDM solutions also allow IT teams to enforce security policies and distribute approved applications. However, their centralized management capabilities and privileged access can make them attractive targets when abused by threat actors.
Indicators of Compromise (IOC) List
Domains/URLs | https://webdocusign.viewportal.es/Windows/download/index.php relay.bobdthjau.com:8041 https://www.google.com/url?q=https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b&source=gmail&ust=1786728797008000&usg=AOvVaw1avg1ySoejqEF3554JUp0i https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/14/enroll14.php relay.pronconetydesire.online:8041 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://webdocusign.viewportal.es/Windows/download/index.php" or url like "https://webdocusign.viewportal.es/Windows/download/index.php" or siteurl like "https://webdocusign.viewportal.es/Windows/download/index.php" or domainname like "https://www.google.com/url?q=https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b&source=gmail&ust=1786728797008000&usg=AOvVaw1avg1ySoejqEF3554JUp0i" or url like "https://www.google.com/url?q=https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b&source=gmail&ust=1786728797008000&usg=AOvVaw1avg1ySoejqEF3554JUp0i" or siteurl like "https://www.google.com/url?q=https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b&source=gmail&ust=1786728797008000&usg=AOvVaw1avg1ySoejqEF3554JUp0i" or domainname like "https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/14/enroll14.php" or url like "https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/14/enroll14.php" or siteurl like "https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/14/enroll14.php" or domainname like "https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b" or url like "https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b" or siteurl like "https://teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com/teams/?c4ca4238a0b923820dcc509a6f75849b" or domainname like "relay.bobdthjau.com:8041" or url like "relay.bobdthjau.com:8041" or siteurl like "relay.bobdthjau.com:8041" or domainname like "relay.pronconetydesire.online:8041" or url like "relay.pronconetydesire.online:8041" or siteurl like "relay.pronconetydesire.online:8041" |
Reference:
MDM Abuse for Malicious Activities