TeamViewer urges users to patch 'as soon as possible': audit the remote access tools of your Mexico operation and find the RMM nobody installed

Today, September 30, TeamViewer published an urgent advisory: its Windows, macOS and Linux clients carry severe flaws and need updating right away, as BleepingComputer reported. If you run an operation in Mexico from abroad, TeamViewer is almost certainly on the PCs at your plant in Monterrey or your office in Mexico City. Your local provider probably installed it. Or the accountant did, to work from home, and nobody removed it.

The same day brought a second story that belongs next to it. A phishing campaign called CSuite, aimed at US companies, steals Microsoft 365 sessions and then installs legitimate remote access tools such as AnyDesk, Atera or ScreenConnect to stay inside quietly, according to The Hacker News. So yes, patch today. But also count how many remote access doors your Mexico site has, and who holds the keys.

What TeamViewer said and what to do today

TeamViewer is a remote access tool: software that lets someone see and control a computer from somewhere else. The flaws sit in the client, the program installed on each machine. Patching means updating PC by PC, not only the technician’s laptop.

Step one, today: on every device, open TeamViewer, go to Help and then Check for updates. With twenty PCs and a server in Mexico, ask your local provider to push it from their inventory tool and send you the list of versions when done. Under a normal support plan that takes a morning.

While you are at it, look at the last connection date. If nobody has used TeamViewer on that machine for months, remove it. Fewer doors, fewer patches.

The real problem: the remote access nobody installed

CSuite works like this. An email arrives with a supposed document, the user signs in to Microsoft 365 on a fake page, and the attacker steals the session, not the password. Once inside, they install an RMM. RMM stands for remote monitoring and management, the software IT providers use to administer many PCs at once. It is legitimate, digitally signed, and antivirus lets it through. That is exactly why attackers like it.

BleepingComputer also reported yesterday a second route: custom ChatGPTs that ask the user to copy and paste a command “to fix an error”. That technique is called ClickFix, and the command installs a RAT, a remote access trojan. The user runs it with their own hands.

In our experience, an office of twenty PCs in Mexico almost always has two or three different remote access tools. Nobody remembers who installed the third one. When HQ sits in another country, the odds go up.

A one-afternoon inventory of your Mexico site

You do not need expensive software for the first pass. Control Panel, installed programs, and the Startup tab of Task Manager. Server by server, PC by PC, with this table at hand. If you cannot be there, this is the exact list to send your local provider.

What to record	Why it matters
What is installed: TeamViewer, AnyDesk, Atera, ScreenConnect, Splashtop, RustDesk	Each one is a door into the network
Who approved it and when	If nobody remembers, be suspicious
Version	TeamViewer must be today’s release
Whether it starts with Windows	An “always ready” access is an intruder’s favorite
Which account it connects with	A fixed password without MFA is the worst item on the list

With the results, pick one official tool for HQ and Mexico alike, with MFA (two-step verification) and a log of who connected and when. Block the rest through group policy or your EDR, the modern antivirus that watches behavior rather than files. If it is not on the list, it does not run.

Your provider’s own tool counts too. We covered that with the ScreenConnect flaw. Ask them what they use and which version.

Kill the Microsoft 365 sessions that may have been stolen

Because CSuite steals sessions, MFA alone does not help once they are in. In the Microsoft 365 admin center, starting with management and finance, do three things: sign the user out of all sessions, check Outlook for odd forwarding rules, and review sign-ins from countries where you have no staff. Then reset the password.

Let's talk

What about your Mexico operation?

With a ProcessBi support plan, the TeamViewer and AnyDesk patches go out today to every device at your Mexico site, we pull the remote access inventory with our tool and standardize on one option with MFA, with a report in English for HQ. Without a plan, we do a one-off remote review or a field visit to your office, plant or store.

Request a remote access review — we reply the same business day.