Software Review Comodo Internet Security vs targeted ransomware attack.

Video Reviews - Security and Privacy
71 Replies 13,273 Views
Reviews reflect the reviewer's setup and methods. Check the evidence and limitations.
Thread details
Content created by
me
Another example of using RemoteAdmin against home users (the audience most likely to own a high-performance discrete GPU):
www.microsoft.com

From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities | Microsoft Security Blog

Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.
www.microsoft.com

"The operator runs a coordinated SEO poisoning operation that simultaneously masquerades as a broad portfolio of trusted utility brands, where each one serves the same downstream payload chain.
The campaign abuses multiple trusted brands, including: CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. The selection of these brands is deliberate. Each application is favored by PC enthusiasts and hardware-focused users, precisely the audience most likely to own a high-performance discrete GPU, the hardware that makes GPU cryptocurrency mining economically viable."

1785356205713.png


In this example, CIS can be compromised in the default configuration, and the RemoteAdmin tool is installed. Then a connection to the C2 server is established to download/execute the EXE malware (SimpleRunPE.exe = PE loader). The hash of this EXE loader is unknown (so far) to Comodo Valkyrie, so the file is Unrecognized to CIS and contained. As in the previous example, the attack can be mitigated by CIS before the final payload is executed.
 
Last edited:
Even more dangerous attack via the RemoteAdmin tool was reported here:
www.huntress.com

How a Tax Search Leads to Kernel-Mode AV/EDR Kill | Huntress

Huntress uncovers a tax-themed malvertising campaign using Google Ads, dual cloaking, rogue ScreenConnect, and an undocumented Huawei driver to kill AV/EDR.
www.huntress.com www.huntress.com

"During retrospective threat hunting, the Huntress Tactical Response team recently uncovered a large-scale malvertising campaign that has been active since at least January 2026, targeting U.S.-based individuals searching for tax-related documents. The lures are specifically U.S. tax forms (W-2, W-9), and the fake landing pages reference IRS compliance, casting a wide net across employees, freelancers, contractors, and small businesses during filing season. The campaign abuses Google Ads to serve rogue ScreenConnect (ConnectWise Control) installers, ultimately delivering a BYOVD EDR killer that drops a kernel driver to blind security tools before further compromise. Across our customer base, we reported over 60 instances of rogue ScreenConnect sessions tied to this campaign being used as the initial access vector.

The attack chain is layered: dual commercial cloaking services filter out researchers and scanners, trial ScreenConnect instances provide hands-on-keyboard access, a multi-stage crypter evades AV with a 2GB memory allocation trick, and the final payload abuses a previously undocumented Huawei audio driver to terminate Defender, Kaspersky, and SentinelOne processes from kernel mode."

In this dangerous & massive attack, after installing the RemoteAdmin tool, a multi-stage crypter (EXE file) was downloaded and executed to finally kill AV/EDR solutions by applying the BYOVD EDR killer.
In the case of CIS, the system could be compromised by the RemoteAdmin tool, but the multi-stage crypter is unknown (so far) in the Comodo Valkyrie Sandbox, so the malware would be auto-contained.
 
Andy Ful said:
In the case of CIS, the system could be compromised by the RemoteAdmin tool, but the multi-stage crypter is unknown (so far) in the Comodo Valkyrie Sandbox, so the malware would be auto-contained.
Click to expand...
Some informative really articles here. I'll have to set aside time to read them but sounds like even though bypassed by the remote admin, I'm reading your comments that in all these cases, at the end of it, Comodo sandboxes and contains the unknown payloads. (y)
 
ErzCrz said:
Some informative really articles here. I'll have to set aside time to read them but sounds like even though bypassed by the remote admin, I'm reading your comments that in all these cases, at the end of it, Comodo sandboxes and contains the unknown payloads. (y)
Click to expand...

Yes.(y)
So far, I have not found an example of a non-targeted attack in the wild that could fully infect CIS users (CIS Proactive Security configuration).
In the @Shadowra test, you can see some installed malware (not only related to WiseConnect). This can happen because some MSI installations simply extract files, copy them to "C:\Program Files" or the user's AppData folders, and add some registry keys without any response from CIS. However, in the end, the installed malware is contained during execution. CIS is not perfect, but secure at home so far. It must be supported by a good malware cleaner to remove leftovers.
 
Last edited:
I compared the results of the CIS test with an older test for Xcitium conducted by @Shadowra three years ago:
Shadowra

Software Review Thread 'Xcitium Advanced with OpenEDR Combined'

Xcitium is the enterprise brand of American solution provider Comodo.
I was going to make 2 separate versions, but the solution let me install their EDRs, so I decided to combine them together.
Let's see if it keeps its reputation or not...



Interface: 10/10

The interface is clearly that of the consumer version of Comodo!
On the other hand, there's no choice of configuration by profile: everything is done via the...
  • Like
  • +Reputation
  • Thanks


There was an interesting difference when managing MSI installations. Xcitium rated msiexec.exe (which hosts opening MSI files) as Unknown and fully contained the installation. In the CIS case, msiexec.exe has been rated as Trusted (not contained).
I wonder if this difference is related to different hardening settings for msiexec.exe in Script Analysis.:unsure:
 
Just want to correct a few things from the above discussions:
1). regarding ScreenConnect, although having a valid signature in order for this malicious form to work (potentially steal) it MUST be able to connect out. I finally found a sample that was able to be installed (leaving the Kaspersky residue seen in the recent video), but when Outbound Connectivity is checked from within Comodo it can be seen that connections were blocked.

2). CF does indeed contain msiexec.
MSI contained.png


Screen Connect.png
 
cruelsister said:
Just want to correct a few things from the above discussions:
1). regarding ScreenConnect, although having a valid signature in order for this malicious form to work (potentially steal) it MUST be able to connect out. I finally found a sample that was able to be installed (leaving the Kaspersky residue seen in the recent video), but when Outbound Connectivity is checked from within Comodo it can be seen that connections were blocked.

2). CF does indeed contain msiexec. View attachment 299142
Click to expand...

In the test, msiexec.exe is always rated as Trusted for all MSI samples (not only ScreenConnect), and it is not contained.
 
Last edited:
The minor issue seen with ScreenConnect is due to the file type. Screenconnect comes in both msi as well as PE32 (exe). Noting that most samples (in either case) will be legitimately signed the installation riff-raff seen by Kaspersky will indeed occur with some PE32 samples. However the main thing that will be the blocking of any outbound connection being allowed.

For any re-test setting Comodo in silent Mode may prove to be more efficient. However why bother as unchangeable opinions exist. Also your video production plate (totally appreciated by ALL!) I'm sure is already rather burdensome...

(ps- CF is fine against dll-sideloading. Just run a Sodinokibi ransomware or a Remcos stealer to confirm).
 
Last edited:
CIS could protect against the Sodinokobi or Remcos payloads, not because it can effectively detect/block DLL hijacking, but because the attack was auto-contained before the DLL hijacking attempt. In such a case, the DLL payload is loaded from the sandbox by the Trusted but already sandboxed process, so there is no harm to the system.
In the examples provided in this thread (like in the OP), the attack is not auto-contained either before or after the DLL hijacking attempt. The malware runs in the Trusted process's memory outside the sandbox. This is possible because the infection chain does not include standard techniques (scripts, non-Trusted EXE files, etc.), which can be easily auto-contained by CIS.(y)

CIS can be considered fine, because most DLL hijacking attacks in the wild are intended to bypass the next-gen AVs/EDRs. Many attacks are multistaged, and CIS can often contain the attack before or after the DLL hijacking attempt when scripting or non-Trusted EXE files are used in the infection chain.

Post edited for more clarity.
 
Last edited:
How CIS could prevent some Sodinokobi/REvil and Remcos attacks despite DLL hijacking.

The infection chain part in blue is auto-contained by CIS.

Sodinokobi/REvil infection chain (simplified):
Malicious update (Kaseya VSA Agent Hot-fix) ---> PowerShell code executed ---> payloads downloaded ---> DLL hijacking ---> REvil ransomware

Remcos infection chain (simplified):
LNK files or PowerShell scripts downloaded ---> PowerShell code executed ---> ZIP archive with hijackloader ---> DLL hijacking ---> Remcos

blog.qualys.com

REvil Ransomware Attack Analysis | REvil Group Insights | Qualys

Explore the REvil ransomware attack and learn how the REvil group operates. Get detailed insights into REvil attack methods, impact, and mitigation strategies.
blog.qualys.com blog.qualys.com
www.ibm.com

Hive0156 continues Remcos campaigns against Ukraine | IBM

IBM X-Force is monitoring active Hive0156 Remcos Remote Access Trojan (RAT) campaigns targeting victims of Ukraine. Learn more about this threat.
www.ibm.com www.ibm.com

Update (9.08.2026)
About the issue related to the isolation time limit:
 
Last edited:
Comodo/Containment does not include DLL sideloading protection; basically, Comodo relies on its rules—it will contain everything if the host/parent is unrecognized. If I recall correctly, HIPS, not containment, had DLL sideloading protection, which they removed later.
In all POCs here, the testers use host/parent Comodo trusts; Comodo performed in these tests as per its security design/rules. The POCs should not damage the system if you run them with the context menu "Run in Comodo Container" item, treating the host/parent as unrecognized.
 
rashmi said:
In all POCs here, the testers use host/parent Comodo trusts;
Click to expand...

Yes. I often use the term "abusing Trusted files" in my posts. This can be done in several ways, such as exploiting software, PE injection via MS Office macros, DLL hijacking, using uncommon (but Trusted) scripting engines, modifying Electron apps, and probably some others. All those methods can bypass CIS Auto-containment. There is no problem dismantling CIS (in most popular settings) in highly targeted attacks.
However, in most in-the-wild cases, CIS can still prevent full infection because attacks are primarily designed to bypass Next-Gen AVs. Those methods are used only as part of a multi-staged attack, and CIS can often contain the final stage.
 
Last edited:
I gathered the available professional tests related to CCS (Comodo Client Security) and Xcitium.
Comodo vendor suggests that the results should be the same for CIS.

www.av-test.org

Test antivirus software Comodo

The current tests of antivirus software from Comodo of AV-TEST, the leading international and independent service provider for antivirus software and malware.
www.av-test.org www.av-test.org

www.av-test.org

Test Xcitium Client Security 12 for Windows 10 (222509)

The current test Xcitium Client Security 12 for Windows 10 (222509) from October 2022 of AV-TEST, the leading international and independent service provider for antivirus software and malware.
www.av-test.org www.av-test.org

www.av-test.org

Test antivirus software Kaspersky

The current tests of antivirus software from Kaspersky of AV-TEST, the leading international and independent service provider for antivirus software and malware.
www.av-test.org www.av-test.org

AV-Test 2020-2023, 10 tests (Real-World Testing)
Missed samples
CCS .................................. 1 (October 2022)
Kaspersky ES ............... 3 (June, December 2022 + June 2023)

---------------
avlab.pl

Recent Results » AVLab Cybersecurity Foundation

The latest results of the Advanced In-The-Wild-Malware Test, in which we regularly evaluate software designed to protect devices.
avlab.pl avlab.pl

AVLab 2022-2025, 23 tests
Missed samples
Xcitium/CIS ................... 1 (July 2025)
Avast ............................... 0

----------------
www.av-test.org

Advanced Threat Protection against the latest Data Stealers and Ransomware Techniques

Protection solutions for consumer Windows PCs or corporate user workstations require the best protection against the latest attack techniques. The lab at AV-TEST examined a total of 25 security products under Windows 11 in terms of how well they detect and fend off the new attack technique...
www.av-test.org www.av-test.org
www.av-test.org

Fending off Ransomware even Against State-of-the-art Attack Techniques

APT groups that attack with ransomware use many different attack tactics to achieve their objectives. AV-TEST staged attacks on security products for consumer users and corporate users in 10 currently used scenarios each deploying the techniques ".Net Reflective Assembly loading”, ".Net Dynamic...
www.av-test.org www.av-test.org
www.av-test.org

Security Software against the latest Ransomware Techniques

In a comprehensive evaluation, AV-TEST analyzed security products for consumer users and corporate users. All products were required to stand up against the latest ransomware techniques. Those deployed included shrewd techniques such as polyglot files, DLL sideloading or nested password...
www.av-test.org www.av-test.org
www.av-test.org

Defending against Ransomware: 28 Protection Solutions Put to the Test under Windows 10

The fight against ransomware is a two-front battle waged both on home PCs and corporate workstations. How well does security software protect against these diabolical encryption attackers? In the current November test, 15 Internet security suites for consumer users and 13 solutions for corporate...
www.av-test.org www.av-test.org
www.av-test.org

Protection Solutions vs. Ransomware in the Advanced Threat Protection Test

All major ransomware attacks follow a certain attack pattern of APT groups. That's why the lab at AV-TEST simulated attacks on 14 protection solutions for corporate users with 10 sophisticated Advanced Persistent Threat scenarios, trying to encrypt the systems per ransomware. In doing so, each...
www.av-test.org www.av-test.org

Xcitium/CCS covered all techniques used in the Advanced Threat Protection tests, just like top products.

----------------

From those tests, it follows that CIS can cover the attack vectors typically used in the wild (at least as well as top business products).
However, those attack vectors do not include the methods presented in this thread (see my previous post).
 
Last edited:

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top