AnyDesk Security Breach 2024: What Actually Happened
AnyDesk security breach: source code stolen, certificate compromised, 18,317 credentials on dark web. What IT teams need to know. (CrowdStrike, 2024)
Two events reshaped the remote desktop market in 2024: AnyDesk suffered the theft of its source code and code-signing certificate in January, and TeamViewer absorbed an APT29 intrusion into its corporate IT network in June. Both incidents were contained — but they exposed very different security architectures, and they've made the TeamViewer vs AnyDesk question more consequential than ever.
AnyDesk also changed its entire licensing model in October 2025, shifting from user-based to connection-based pricing. If you're evaluating remote access tools right now, both the security posture and the cost structure look different than they did 18 months ago.
This comparison uses verified pricing from April 1, 2026, official incident reports, and published performance benchmarks.
TL;DR: TeamViewer costs more ($10,424/yr median real spend) but holds SOC 2 Type 2 and ISO 27001. AnyDesk is faster (16.5ms latency) and cheaper ($14.90/mo) but lacks both certifications — and suffered a more severe 2024 breach. For IT teams managing 50–5,000 devices, Sobrii Remote includes remote control in every plan at €12–20/device/year with full fleet context before every session.
The remote desktop market has two structural shifts working simultaneously. AnyDesk moved to connection-based licensing in October 2025, making cost modeling harder for high-volume IT teams. TeamViewer's list prices look manageable — until you factor in the add-ons. The median real spend across 25 verified purchases is $10,424 per year (costbench.com, 2026), far above what the $229.90/month Corporate plan suggests.
Both tools are rated 4.5/5 on G2. Both were breached in 2024. The differences that actually matter for IT teams and MSPs are in the security certifications, the enterprise feature depth, the codec performance, and the true cost of ownership — not the star rating.
| Plan | Per Month | Concurrent Sessions | Managed Devices | Users | |------|-----------|---------------------|-----------------|-------| | Remote Access | $24.90 | 1 | 3 | 1 | | Business | $50.90 | 3 | 200 | 1 | | Premium | $112.90 | 10 | 300 | 15 | | Corporate | $229.90 | 15 | 500 | 30 | | Tensor (Enterprise) | Custom | Unlimited | Unlimited | Unlimited |
Source: costbench.com, tekpon.com
Critical caveat: These base prices exclude mobile device management, asset management, endpoint protection, and AR modules — all charged as add-ons. The average negotiated discount is 30% off list price, but the median actual spend ($10,424/yr) reflects what organizations pay once they've built a complete feature set. Auto-renewal requires 28 days' cancellation notice.
TeamViewer's feature advantages are concentrated in three areas that AnyDesk doesn't match:
Native MP4 session recording. Sessions export as standard MP4 files, playable in any video player. This matters for compliance documentation, incident review, and legal evidence — not just IT convenience.
Browser-based client with no installation. Operators can connect from a browser tab without installing anything on either side. AnyDesk has no native equivalent.
Assist AR (augmented reality troubleshooting). Operators can annotate the remote user's live camera feed in real time. Exclusively available in TeamViewer — useful for field technicians and industrial equipment support.
Account-based unattended access. No password needed — access is tied to the TeamViewer account with full audit trail. AnyDesk's unattended access uses tokens and passwords that require manual setup.
Auto UAC elevation on Windows. Windows Authentication handles privilege elevation automatically. AnyDesk requires manual UAC approval from the remote user.
TeamViewer also includes AI session summarization — 270,000+ IT support sessions were automatically summarized in 2024 — and a built-in meeting/screen-sharing tool.
TeamViewer holds a full enterprise certification stack: ISO/IEC 27001 (renewed 2025), SOC 2 Type 2, SOC 3, HIPAA/HITECH, TISAX, and CSA STAR Level 2. For regulated industries, this is a decisive advantage over AnyDesk.
The June 2024 breach (APT29). On June 26, 2024, TeamViewer detected an anomaly in its corporate IT network. The threat actor was APT29 / Midnight Blizzard — Russia's SVR foreign intelligence service. What was compromised: the employee directory (names, corporate contact info, encrypted passwords). What was not affected: the product platform, customer data, active connection sessions.
Citation capsule — TeamViewer Security Bulletin TV-2024-1005 (July 2024): "Our product environment is completely separated from the corporate IT environment. TeamViewer can confirm that based on current investigations, the product environment and customer data are not affected." — Source
The incident was contained within 8 days, with Microsoft Security co-leading the investigation. Context matters: this was a sophisticated nation-state attack targeting corporate credentials — not a product or infrastructure vulnerability. TeamViewer's environment segmentation worked.
TeamViewer fits organizations that need to demonstrate compliance (SOC 2, ISO 27001, HIPAA), use AR for field support, require MP4 session recordings for audit trails, or deploy at scale with mature RBAC and conditional access (Tensor tier). The cost is justified when these use cases are active. It's harder to justify for small IT teams using only basic remote support.
| Plan | Per Month | Licensing Model | Managed Devices | |------|-----------|-----------------|-----------------| | Free | $0 | Non-commercial | 3 (basic) | | Solo | $14.90 | Per connection (since Oct. 2025) | Up to 100 | | Standard | $29.90 | Per connection | Up to 500 | | Advanced | $69.90 | Per connection | Up to 1,000 | | Ultimate/Enterprise | Custom | Unlimited | Unlimited |
Source: costbench.com
Licensing model change (October 2025). AnyDesk migrated from user-based to connection-based licensing. Legacy user-based licenses are being phased out. This shift can significantly change cost projections for high-volume teams — run a connection volume analysis before signing.
AnyDesk's proprietary DeskRT codec is its clearest technical differentiator. Independent benchmarks (ScienceSoft):
On degraded connections — slow VPNs, mobile 4G, congested networks — AnyDesk consistently outperforms TeamViewer. It's the practical choice when network quality can't be guaranteed.
Limitations to know. Session recordings use a proprietary .ANYDESK format — not playable without the AnyDesk application. Privacy Mode doesn't fully hide UAC dialogs from the remote operator. Unattended access requires manual password/token setup. Support hours are limited: ~9 hours/week (8:00–17:00 CET, Mon–Fri) for paid users.
The AnyDesk breach is the more severe of the two 2024 incidents. Here are the documented facts:
Timeline. Attackers likely entered in December 2023. Internal discovery occurred in January 2024. The AnyDesk portal was offline January 29 – February 1, 2024. Public disclosure happened February 2, 2024.
What was stolen.
Certificate abuse. Over 500 malicious binaries signed with the stolen certificate were uploaded to VirusTotal, including Agent Tesla trojans. Some samples date back to June 2022 — raising the question of whether the certificate was compromised earlier than the January 2024 detection.
Citation capsule — Cybereason Threat Alert (2024): "The stolen certificate was used to sign more than 500 distinct malware samples. Some samples date back to June 2022, suggesting the certificate may have been compromised well before AnyDesk's January 2024 detection." — Source
AnyDesk's response. Revoked all security certificates, issued new code-signing certificates, released AnyDesk v8.0.8 (Windows) with the new certificate, forced a portal password reset for all users, activated CrowdStrike for incident response.
Current security posture. AnyDesk does not hold ISO/IEC 27001 at the company level — only its datacenter partners do. AnyDesk does not hold SOC 2 Type 1 or Type 2. Encryption is AES-256 / TLS 1.2. 2FA is available. GDPR compliance is maintained.
Is AnyDesk safe in 2026? For standard, non-regulated use: yes. New certificates are in place, passwords were reset, and the CrowdStrike partnership is ongoing. The reservation applies to compliance-heavy environments: the absence of company-level ISO 27001 and SOC 2 is a real gap that can't be papered over with "our datacenter partners are certified."
| Criteria | TeamViewer | AnyDesk | |----------|-----------|---------| | Entry price (commercial) | $24.90/mo | $14.90/mo | | Median real spend | $10,424/yr (with add-ons) | Not published | | Licensing model | Per user | Per connection (since Oct. 2025) | | Free tier | Yes (non-commercial, 1 session, 5 devices) | Yes (non-commercial, 3 devices) | | Concurrent sessions (entry) | 1 (Remote Access) / 3 (Business) | 1 | | Managed devices (entry) | 3 (Remote Access) / 200 (Business) | 100 (Solo) | | Session recording format | MP4 (standard) | .ANYDESK (proprietary) | | Codec / performance | Standard | DeskRT (16.5ms latency) | | Browser client | Yes (no installation) | No native option | | Mobile support | Yes (add-on on lower tiers) | Yes (included) | | File transfer | Yes | Yes | | Unattended access | Account-based (no password) | Token / password-based | | UAC elevation | Automatic (Windows Auth) | Manual required | | AR troubleshooting | Yes (Assist AR) | No | | Multi-monitor | Tabs/windows view | Icon-based switching | | 2FA | Yes | Yes | | SSO/SAML | Tensor (enterprise) only | Enterprise only | | ISO 27001 | Yes (company-certified) | No (datacenter partners only) | | SOC 2 Type 2 | Yes | No | | HIPAA | Yes | Not documented | | 2024 breach | APT29 — employee directory only | Source code + signing cert + dark web credentials | | MSI mass deployment | Yes (enhanced on Tensor) | Available | | RBAC | Yes (Tensor) | Basic | | Audit logs | Full API + logs | Session logs | | Platform support | Win, Mac, Linux, Android, iOS, ChromeOS, browser | Win, Mac, Linux, Android, iOS, Raspberry Pi, ChromeOS, FreeBSD, Apple TV | | Cancellation notice | 28 days | Not specified | | G2 rating | 4.5/5 (3,715 reviews) | 4.5/5 (3,000+ reviews) | | Capterra rating | Not extracted | 4.6/5 (1,765 reviews) |
Neither TeamViewer nor AnyDesk is designed for IT teams managing fleets of hundreds to thousands of endpoints. They're remote access tools first — you pay separately for asset management, battery health reporting, security compliance scoring, and MSP dashboards. If you're paying for all of those separately, the math changes.
Sobrii Remote is included in every Sobrii plan — no separate license, no add-on. The structural difference from TeamViewer and AnyDesk: you know the state of the endpoint before you connect.
Fleet context before every session. CPU load, battery health, disk space, installed applications, security compliance score — all visible in the dashboard before opening a session. You arrive informed, not blind.
Device-based pricing, not session-based. €12 to €20 per device per year depending on volume. No surprises from connection volume, no annual negotiation, no 28-day cancellation window.
| Sobrii Plan | Devices | Price/device/year | |-------------|---------|-------------------| | Starter | 50–200 | €20 | | Essential | 200–500 | €18 | | Business | 500–2,000 | €15 | | Enterprise | 2,000–5,000 | €12 |
Native MSP multi-tenancy. Full tenant isolation, per-client reporting, single dashboard across all clients — no extra MSP licensing layer. TeamViewer and AnyDesk both charge separately for MSP access.
WebRTC with 4 privacy levels. Modern protocol, no proprietary codec dependency, no vendor lock-in on recording formats.
Lightweight Rust agent. Same tech stack as Sobrii's agent-orchestrator — minimal footprint, auditable security model.
If you're already paying separately for asset management and remote access, Sobrii Platform consolidates both in a single plan.
For standard non-regulated use: yes. New code-signing certificates have been in place since January 2024, all user passwords were reset, and the CrowdStrike partnership provides ongoing incident response coverage. AnyDesk v8.0.8+ uses the new certificate. The gap that remains is in compliance certifications: AnyDesk doesn't hold ISO 27001 at the company level or SOC 2 Type 2 — which matters for regulated industries regardless of the breach response quality.
It depends entirely on which features you'll actually use. If SOC 2 compliance documentation, ISO 27001 certification, MP4 recordings, AR field support, or enterprise RBAC are active requirements — TeamViewer is worth it. If you're paying $50.90/month for basic remote access and using 20% of the platform, it's hard to justify. The 28-day cancellation notice and the add-on pricing model mean the real total cost is almost always higher than the plan price suggests. Calculate your complete stack before signing.
AnyDesk wins on entry price: $14.90/month vs $24.90/month for TeamViewer. But the comparison needs context. TeamViewer Business ($50.90/month) covers 200 devices — changing the per-device math for larger teams. AnyDesk's new connection-based pricing (October 2025) can make costs unpredictable at high volume. Add TeamViewer's median real spend ($10,424/year including add-ons) and the gap narrows for any organization using the full feature set.
AnyDesk is objectively faster on degraded connections. DeskRT hits 16.5ms latency (ScienceSoft benchmark) and 59.9 FPS. TeamViewer doesn't publish equivalent benchmarks. On high-quality LAN connections, the difference is negligible. On slow VPNs, mobile 4G, or congested enterprise networks, AnyDesk has a measurable, practical advantage.
Yes. In June 2024, APT29 (Midnight Blizzard, Russian SVR) penetrated TeamViewer's corporate IT network. What was compromised: the employee directory (names, contact info, encrypted passwords). What wasn't affected: the product platform, customer data, active sessions. The incident was contained in 8 days with Microsoft Security support. The key difference from AnyDesk: no source code and no product code-signing certificates were stolen.
TeamViewer (Tensor) offers a more mature MSP stack: granular RBAC, full audit log APIs, Google Cloud and Azure Marketplace integrations. AnyDesk offers REST API and multi-instance support on Advanced, but multi-tenant isolation is less developed. For MSPs managing 200+ client endpoints, Sobrii Remote — with native multi-tenancy and per-device pricing — is worth evaluating as an alternative to both.
If neither TeamViewer nor AnyDesk meets your needs, see our full roundup of TeamViewer alternatives in 2026 — covering Splashtop, RustDesk, Zoho Assist, and Sobrii Remote with verified pricing.
For a broader look at managing unsanctioned tools in your fleet, see our guide on shadow IT detection — covering how unauthorized software spreads across endpoints and how to regain visibility.
Discover how sobrii transforms IT fleet management.
Book a demo