Some of these IP addresses change over time, while others seem to be mostly static. Initial ObservationsД«y observing the DNS names, weвЂ™re able to see that TeamViewer has very easily-identifiable domains and subdomains, and includes several disparate IP address ranges.ДЇigure 1: Identifying IPs and SubdomainsIn fact, at the time of this writing, there are 16 master servers ( master1 вЂ“ master16), hundreds of normal servers across numerous IP ranges, as well as a number of other publicly-reachable infrastructure devices. Each of these occurrences take advantage of the fact that TeamViewer is a common remote support tool and can aggressively avoid attempts to detect or block it. Additionally, a piece of malware named SkywyderвЂ“which I found on the Dark Web sometime in mid 2016вЂ“leverages TeamViewer. Since then, the Shade ransomware took advantage of TeamSpy, andвЂ“ more recentlyвЂ“other spam campaigns have been using it. In 2013, a report came out that discussed how a surveillance tool named TeamSpy had been using TeamViewer for roughly a decade. TeamViewer has been part of the threat actorвЂ™s arsenal for years. Now itвЂ™s time to learn what TeamViewer has up its sleeve. In our first foray into this subject, we learned about the types of techniques LogMeIn uses and how they can circumvent security controls. Given these tools make the network perimeter more permeable than security teams may realize, it is important to know who is initiating the connection, and where the communicating devices reside - especially if this isnвЂ™t the approved remote access solution. In the original post of this series, I set the stage for why remote access capabilities should be analyzed more carefully.

Teamviewer connection not established