Threat Model · 10 min read
Exam Cheating Uses Attacker Tradecraft, Not Student Tricks
Open MITRE ATT&CK technique T1219, Remote Access Tools. It is a Command and Control technique, and the entry names the software adversaries use: AnyDesk, TeamViewer, Google Chrome Remote Desktop, LogMeIn, ScreenConnect, MeshCentral, ngrok. The threat groups listed as using it include Sandworm Team, OilRig, FIN7, Akira, BlackByte and Medusa.
Now open the teardown of a certification proxy ring. The kit is a hardened virtual machine, a remote-control tool, and a residential-IP relay. The remote-control tool is RustDesk, AnyDesk, or a custom dwagent build.
Three of the tools are on both lists. Not analogous tools. The same executables.
The same technique IDs, catalogued by the same framework
Security teams describe adversary behaviour using ATT&CK because it is vendor-neutral and specific. Run exam fraud through the same catalogue and it does not need a special vocabulary. It is already covered.
| What the proxy ring does | ATT&CK technique | Also used by |
|---|---|---|
| Operator drives the candidate's machine via AnyDesk, RustDesk, TeamViewer | T1219 Remote Access Tools | Sandworm Team, OilRig, FIN7, Akira, Medusa |
| Traffic routed through residential-IP relays so an overseas operator looks local | T1090.003 Multi-hop Proxy | Broad; standard C2 obfuscation |
| Paid expert sits the exam while the registered candidate reads a script on camera | T1656 Impersonation | DPRK IT worker operations |
| Anti-detection VM fingerprinted to look like an ordinary laptop | Virtualisation and sandbox evasion checks | Commodity malware |
The last column is the part worth sitting with. Sandworm Team is GRU Unit 74455, the group behind the attacks on Ukraine's power grid. OilRig is Iranian state-linked. FIN7 is one of the most successful financial-crime crews on record.
The technique a GRU unit uses for command and control is the technique a proxy service uses to sit a CPA exam. The tooling overlaps because the objective is structurally identical: get a remote operator hands-on control of a machine that is supposed to be under someone else's exclusive control, and make the traffic look like it came from where the machine is.
Remote-access abuse is a solved-enough problem for enterprises
Defenders worked this out years ago, and the guidance is public.
CISA, the FBI and MS-ISAC published AA23-025A on the malicious use of remote monitoring and management software, and issued an updated joint advisory in July 2025 warning that threat actors are increasingly abusing legitimate RMM software to gain persistent access. CISA's advisory on Akira ransomware documents operators using AnyDesk after gaining access through a VPN. Blackpoint's research counted 17 distinct ransomware operations using AnyDesk by mid-2024.
The reason attackers like these tools is the reason they are hard to catch. Remote-access software is legitimate. It is signed, it is often already present, and it produces an authenticated interactive session with minimal logging and no alert by default. It is living off the land in the most literal sense: the intruder is not carrying a weapon, they are using yours.
Enterprise defenders did not respond by looking harder at the operator. They responded by changing what the environment permits:
- Default-deny egress. If the relay cannot be reached, the session cannot be established, no matter which tool is installed.
- Allowlisting which RMM tools may execute at all, which is the specific control CISA's advisories recommend.
- Network segmentation, so a foothold does not become reach.
- Behavioural EDR that watches what a process does and where it connects rather than what it claims to be.
None of that depends on identifying the tool by name. That matters, because the name is the one property an attacker can change for free.
Where the two threat models turn out to be one operation
The clearest case that assessment security is enterprise security is the North Korean IT worker scheme.
The pattern, as described in Department of Justice indictments of operatives and their US-based facilitators: an operative applies for a remote engineering role using a stolen identity belonging to a real American, so background checks clear. They pass the technical interview. Once hired, a facilitator in the US receives the company laptop and runs it in a laptop farm with RustDesk or AnyDesk installed, or a hardware KVM switch attached, so the operator overseas can work the job as though sitting at the desk. Where no company device is issued, VPNs and residential proxy services make the traffic appear to originate near the fake identity's address.
Read that list again against the proxy-exam kit. Remote-access tool, residential proxy, impersonated identity, a person on camera who is not the person doing the work. It is the same playbook. Reporting on the scheme describes individual operatives earning up to $300,000 a year, with the activity escalating from wage collection into source-code theft and, in one case, ITAR-controlled data taken from a US defence contractor.
The technical interview is not adjacent to the enterprise perimeter. For this class of adversary it is the perimeter, and it is usually the only point where the operation meets a control at all.
If a fraudulent hire clears the interview, every subsequent control, the EDR, the segmentation, the zero-trust access policy, is now being applied to a legitimate authenticated employee. The assessment was the last place the adversary was an outsider.
Why the defences diverged
Enterprise security and assessment security started from different premises and never reconciled.
Enterprise security assumes the environment is hostile and constrains it. Assessment security inherited the invigilated exam hall, where the threat model was a person with a crib sheet, and digitised it: a camera instead of a walking invigilator, a locked browser instead of a quiet room.
Both of those controls target a person behaving suspiciously. Neither targets software establishing a session. That is why a lockdown browser cannot see a remote-access tool: it is an application enforcing policy inside its own process, and the RAT is a separate process that never asked its permission. It is also why a webcam cannot see a residential proxy relay. There is nothing for a lens to observe.
Meanwhile the tooling on the other side got cheaper and better documented. The proxy-ring market runs from roughly $200 for entry-tier certifications to around $10,000 for multi-part licensure exams, based on our own review of publicly indexed proxy marketplaces, detailed on our certification fraud page. That is a funded, professionalised supply chain using catalogued intrusion tradecraft against controls designed for a student glancing at a neighbour's desk.
What actually transfers
The useful consequence of the overlap is that the defences transfer too. Nothing here needs inventing. It needs porting.
Default-deny egress for the session. The single highest-value control, and the same one CISA recommends for RMM abuse. If only assessment-approved destinations resolve, the remote-access relay never opens, the hosted AI endpoint is unreachable, and the proxy operator cannot connect. Note the failure mode this produces: a RAT already installed on the machine keeps running, visibly idle, while the operator watches a frozen screen. It is starved, not killed, which means nobody has to identify the binary first.
Target techniques, not names. A signature list of RAT process names is obsolete the moment a fork is recompiled, which is exactly why ATT&CK is organised around techniques rather than tools. The equivalents on the assessment side are the screen-capture-exclusion flag an overlay must set to stay out of a recording, and the GPU memory footprint a locally running model cannot avoid leaving.
Device attestation before the session, not after. Enterprises check posture before granting access. The assessment equivalent is fingerprinting for virtualisation artifacts so an anti-detection VM is refused before the first question loads, rather than reviewed in a report afterwards.
Ephemerality instead of persistence. Enterprises are moving away from permanent agents holding standing privilege, because the agent becomes the attack surface. A per-session enclave that deploys, enforces, and removes itself is the same instinct applied to a device you do not own.
This is the layer Aiseptor operates at, and the framing above is the reason. It was not designed as proctoring with extra features. It was designed as environment control, because the thing it defends against is catalogued intrusion tradecraft.
What this does not solve
The overlap argument can be pushed too far, so here is where it stops.
- This is not identity verification. Nothing here confirms who is sitting the exam. In the DPRK case the identity layer was the first thing compromised, and it needs its own control.
- It does not cover the room. A phone, a printed page, a second person off-camera, or a hardware capture card between GPU and monitor produce no process and no traffic. Camera and human proctoring still do that job. This is an argument for adding a layer, not removing one.
- Enterprise controls do not port unchanged. A candidate's personal laptop is not a managed corporate endpoint. You cannot install a kernel agent, mandate a device build, or assume any prior posture, which rules out much of the enterprise toolkit and is precisely why an ephemeral, user-space approach exists.
- Not every cheating candidate is an adversary. Most are ordinary people under pressure using a $20 tool. The tradecraft argument describes the upper tail. That tail is where credential validity and hiring integrity actually break.
The summary is uncomfortable but simple. The people building exam-bypass kits read the same offensive-security material as everyone else, and they are executing techniques with published IDs and known countermeasures. Defending against that with a camera and a locked browser is not a lighter version of enterprise security. It is a different discipline, pointed at the wrong layer.
Frequently Asked Questions
Are exam-cheating tools really the same as the ones used in cyberattacks?
In several cases they are literally the same software. MITRE ATT&CK technique T1219, Remote Access Tools, names AnyDesk, TeamViewer and Google Chrome Remote Desktop as tools adversaries use for command and control. Those three also turn up in proxy-exam kits, alongside RustDesk and custom dwagent builds. The technique is identical: install legitimate remote-access software, let an operator elsewhere drive the machine, and route the traffic so it looks local.
Which MITRE ATT&CK techniques map to exam fraud?
The main ones are T1219 (Remote Access Tools) for the proxy operator's session, T1090.003 (Multi-hop Proxy) for residential-IP relays that make an overseas operator look like a local candidate, and T1656 (Impersonation) for the identity layer. These sit under the Command and Control tactic, which is the same catalogue enterprise defenders use to describe ransomware and state-sponsored intrusions.
How is the North Korean IT worker scheme related to exam security?
It is the same operation viewed from a different angle. DPRK operatives use stolen identities to apply for remote engineering roles, pass the technical interview with help, then have a US-based facilitator run a laptop farm with RustDesk or AnyDesk installed so the real operator can work from overseas. The Department of Justice has indicted both operatives and facilitators. The technical interview is the point where that operation is either detected or admitted, which makes assessment security a hiring-security control rather than an academic one.
What do enterprises do about remote-access tool abuse that assessment security does not?
Enterprises stopped trying to spot the intruder and started constraining the environment: default-deny egress, allowlisting which RMM tools may run at all, network segmentation, and EDR that watches process and connection behaviour rather than appearance. CISA's advisories on RMM abuse recommend exactly this. Most assessment security still relies on watching a candidate through a webcam and locking one browser window, which is a control aimed at a person rather than at tradecraft.
Does this mean proctoring is useless?
No. Human and camera proctoring still catches the things it was built for: someone else in the room, a phone in hand, a candidate leaving the frame. What it cannot do is see a remote-access session, a residential proxy relay, or an overlay that has excluded itself from screen capture, because none of those produce anything a camera can observe. The argument is for adding a network and OS layer beneath proctoring, not for removing what already works.
Aiseptor enforces assessment integrity at the network and OS layer: default-deny egress, technique-based detection, and device attestation, with no kernel driver and nothing left on the candidate's machine. See the architecture, or read how proxy rings actually operate.