# Poker-Software Supply Chains Used to Plant a Covert Remote-Access Agent

| | |
|---|---|
| **Credit** | @wolfsec0x0 (X) / KCC Discord |
| **Report date** | 29 September 2026 |
| **Version** | Public release 1.0 |
| **Classification** | TLP:CLEAR, free to share |
| **Scope** | Confirmed findings only. Affected players, software vendors and their products are not named. |

---

## About this report

This is the public version of an ongoing incident investigation led by **@wolfsec0x0** (X) / KCC Discord. The investigation, evidence analysis and findings in this report are the work of @wolfsec0x0. It contains only findings confirmed by preserved evidence, by static analysis of software samples, or (where stated) by the affected software vendor. Suspected cases that are not yet confirmed, inferences about motive and open lines of inquiry have been left out. The one exception is the overall number of affected PCs, which is given as a current estimate and labelled as such.

The two poker-software products used to deliver the agent are called **Tool A** and **Tool B**. Their vendors are called **Vendor A** and **Vendor B**. All times are UTC.

---

## 1. Summary

**What happened.** The agent for **MeshCentral**, a legitimate open-source remote-management product, was installed without the owners' knowledge on **Windows PCs belonging to online poker players**. The investigation has confirmed the agent on multiple PCs, and **current estimates put the total at between 10 and 30**. The players are in several countries, including countries in Europe, North America and Oceania. The agent runs as a Windows service with full system privileges and connects to a server run by a third party. Whoever operates that server can:

- watch the screen live, including a player's own hole cards during real-money play;
- take control of the mouse and keyboard;
- run commands with SYSTEM privileges;
- copy files to and from the PC.

**How it got there.** Two separate, legitimate, code-signed poker utilities were compromised to deliver the agent:

- **Tool A:** vendor-confirmed compromise.
- **Tool B:** backdoored build, confirmed by static analysis. Waiting on vendor confirmation.

**Duration.** The earliest confirmed agent activity is from **March 2024**, when remote command-line sessions were recorded on an affected PC. Where install and removal dates are known, the agent stayed in place for **months, in some cases more than a year**.

**Current status.** On every PC confirmed so far, the agent has since been **removed or disabled**. Other affected PCs may still have it installed. The operator has also been seen uninstalling the agent remotely and deleting the scripts used to do it.


## 2. Timeline of confirmed events

| Date (UTC) | Event |
|---|---|
| **16 Mar 2024** | Earliest confirmed agent activity: the agent log on an affected PC records remote command-line sessions from this date. |
| Apr 2024 | Agent activity on a further PC. |
| Oct 2024 | Agent installation recorded on a further PC. |
| Jun–Aug 2025 | Further PCs are infected. Vendor A later tied install dates from July and August 2025 to a compromised version of Tool A. |
| Oct 2025 – Jun 2026 | The agent service is reinstalled repeatedly on one PC. |
| **Early Mar 2026** | A backdoored Tool B build is signed with Vendor B's valid code-signing certificate, one day after a clean build. |
| 26–28 Sep 2026 | Affected players begin disabling the agent service. |
| **27 Sep 2026** | The operator is seen remotely uninstalling the agent, using self-deleting PowerShell scripts. |
| **29 Sep 2026** | Vendor A confirms that a compromised version of Tool A corresponds to the install dates supplied. |


## 3. How the agent was delivered

Both delivery routes abused legitimate, code-signed Windows utilities used by online poker players.

### 3.1 Tool A

Vendor-confirmed compromise.

### 3.2 Tool B

Backdoored build, confirmed by static analysis. Waiting on vendor confirmation.



## 4. What the agent does on the PC

**Installation**
- Windows service **`Mesh Agent`**, running `C:\Program Files\Mesh Agent\MeshAgent.exe` as LocalSystem and starting automatically.
- The service creation is logged as System event **7045**, under the player's own Windows account.
- The agent files were set **Hidden**.
- The agent uses the stock configuration values `MeshName=default` and `MeshType=2`.

**Connection to the attacker**
- The agent keeps an encrypted connection open to the attacker's server.
- While it is connected, a SYSTEM-level `powershell -noprofile -nologo -command -` process starts roughly **every 20 minutes**. On the PCs where the agent was later removed or disabled, this activity stopped.

**Removal by the operator**
- Two self-deleting PowerShell scripts placed in `C:\Windows` (names withheld) ran the agent's `-fulluninstall` command, deleted the agent files and then deleted themselves.
- These registry keys **survive removal** and remain useful evidence afterwards:
  - `HKLM\SOFTWARE\Open Source\Mesh Agent`
  - `MeshAgent2`
  - `Uninstall\MeshCentralAgent`

**Other activity**
- Microsoft Defender exclusions covering the **entire `C:\Windows` folder** were found on affected PCs. Defender event 5007 records when one is added.
- On one PC the exclusion was removed two minutes after it was added. On others it is **still in place**, so Defender does not scan anything in that folder.

### 4.1 MITRE ATT&CK mapping

| Technique | ID |
|---|---|
| Supply Chain Compromise: Compromise Software Supply Chain | T1195.002 |
| Subvert Trust Controls: Code Signing (Tool B build) | T1553.002 |
| Obtain Capabilities: Tool | T1588.002 |
| Ingress Tool Transfer | T1105 |
| Create or Modify System Process: Windows Service | T1543.003 |
| Hide Artifacts: Hidden Files and Directories | T1564.001 |
| Impair Defenses: Disable or Modify Tools | T1562.001 |
| Remote Access Software | T1219 |
| Command and Scripting Interpreter: PowerShell | T1059.001 |
| Indicator Removal: File Deletion / Clear Persistence | T1070.004 / T1070.009 |

## 5. Impact

For the whole time the agent was installed, whoever ran its server could see everything on the screen, including a player's hole cards during play. They could also reach anything stored on the PC, such as browser-saved passwords, session cookies and saved payment cards. Stolen session cookies can bypass passwords and two-factor authentication until those sessions are revoked.

Where install and removal dates are known, the agent stayed in place for **months, in some cases more than a year**.


## 6. Indicators of compromise

MeshCentral is legitimate software that many organisations use. If an employer or IT provider manages a PC with MeshCentral, the agent may be there legitimately. The file hashes below are **specific to this campaign**. The build hash identifies the agent version, so treat a match on it alone as a lead rather than proof.

**Agent files** (two versions recovered)

| | Version 1 | Version 2 |
|---|---|---|
| SHA256 | `14EDD423232FBCC9EE1C69BB3BC6CF5432CC453E234C3408A7BF2C39018D8092` | `9E3361FC0BFD5D04182BFFA4599985A3128C85A7E84F6D2824481B9C18D33BA1` |
| SHA1 | `2A0B2FCF63CF0FB63EC754C0147772DBCF0233C5` | `A907962D7013F4988D867B686E4821FF7F108BA1` |
| Size | 3,470,088 bytes | 3,468,824 bytes |

**Agent build** (the same across all recovered agents)
- AgentHash: `AD262CB981431433AB750285F81DB1A6F2A5F7A5663217903039840607C593697A82D8E07654D409A7A0EBFDABF30985`
- Build commit date: `2022-Dec-2 11:42:16-0800`

**Host artefacts**
- Service `Mesh Agent`, with System event 7045 recording its creation
- Registry `HKLM\SOFTWARE\Open Source\Mesh Agent`, `MeshAgent2` and `Uninstall\MeshCentralAgent`, which persist after removal
- A SYSTEM `powershell -noprofile -nologo -command -` process roughly every 20 minutes
- Two self-deleting PowerShell removal scripts in `C:\Windows` (names withheld)
- A Microsoft Defender exclusion for the whole `C:\Windows` folder, either still present or recorded in Defender event 5007

**Tool B delivery**
- `C:\Windows\Temp\servicelogger.exe`, run hidden with `-fullinstall`

Network indicators, the removal-script names, and indicators that would identify the affected products or vendors, are withheld from this public version. They are available to security teams on request from @wolfsec0x0 on X or via the KCC Discord.

## 7. Checking a PC

The commands below only read information; they change nothing. Open PowerShell **as administrator**, because Windows only shows Defender exclusions to administrators, and run:

```powershell
Get-Service -Name 'Mesh Agent' -ErrorAction SilentlyContinue
Get-ChildItem 'HKLM:\SOFTWARE\Open Source' -ErrorAction SilentlyContinue
Get-Item 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MeshCentralAgent' -ErrorAction SilentlyContinue
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 7045 } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Mesh Agent' } | Select-Object TimeCreated, Message
(Get-MpPreference).ExclusionPath
```

- **The first four commands:** any output means MeshCentral components are, or were, present.
- **The last command** lists Defender's folder exclusions. If `C:\Windows` appears and you didn't add it, treat the PC as compromised, even if no agent is found.

If you find either one and nobody you trust set it up, follow the steps in Section 8.


## 8. Recommendations

**If you are a player and find the agent or the exclusion**
1. **Disconnect the PC from the internet.** Don't delete anything yet: the evidence matters to police and poker sites.
2. **From a different, clean device:**
   - Change your email password first, then the passwords for your poker sites, crypto exchanges and other accounts.
   - Sign out of all sessions everywhere, and turn on two-factor authentication.
   - Ask your card issuer to replace any card saved in a browser.
   - Move funds out of any software crypto wallet that was on the PC.
3. **Report it** to the security team of each poker site you play on and to your local police or fraud-reporting service.
4. **Wipe and reinstall Windows** once the evidence has been collected. Removing the agent alone is not enough.

**Poker-software vendors**
- Sign update packages, and verify the signature before running anything. Never run a downloaded package on the strength of transport encryption alone.
- Don't let the server assign individual devices to update channels that bypass that verification.
- Protect code-signing keys with hardware-backed storage, and review the build and release pipeline for unauthorised changes.
- Keep logs of which package was served to which device and when, so a compromise can be traced.

**Poker sites**
- Review affected players' accounts for logins from unfamiliar devices or locations.
- The operator could see affected players' screens during play. Consider reviewing table histories for accounts that were seated with affected players unusually often, particularly across more than one affected player.

**Security teams**
- Hunt for the file hashes and host artefacts in Section 6. Network indicators are available on request from @wolfsec0x0.
- Flag any Defender exclusion that covers the whole `C:\Windows` folder, including exclusions still in place today.

## 9. Methodology and scope

- **Evidence.**
  - Live-system collections from affected PCs, covering event logs, registry, Prefetch, Amcache, SRUM, file metadata and agent files.
  - For some PCs, the output of a read-only collection script, supplied by the player.
- **Analysis.**
  - Tool A and Tool B samples were analysed statically only. **No sample was executed.**
  - Agent files were only hashed and signature-checked.
  - **No connection was made to attacker infrastructure.**
- **Vendor confirmation.** @wolfsec0x0 supplied the install dates that Vendor A checked against its own records.
- **Exclusions.** Details of suspected cases that are not yet confirmed, and questions still under investigation, are excluded from this version. Those cases are reflected only in the overall estimate in Section 1. This report may be updated as the investigation continues.

*End of report.*