Acronis Finds Widespread RMM Tool Sprawl and Attacker Abuse
Summary
Acronis analyzed telemetry from over 1.8 million managed endpoints and found widespread use of multiple remote access tools, alongside attacker abuse of tools such as MeshAgent, Ammyy Admin and RDP.
Key points
- In Acronis's inventory data, 63.1% of managed endpoints had at least two remote access or RMM tools installed, and over 22% had three or more.
- The analysis covered application inventory and EDR incidents from January 2025 through March 2026; Acronis notes its endpoints also ran Acronis RMM and cyber protection products.
- Acronis found MeshAgent and Ammyy Admin far more often in malicious incidents than in legitimate installations, while ConnectWise ScreenConnect and AnyDesk were much more common in legitimate environments.
- RDP accounted for almost 26% of malicious RMM-related incidents in the data; Acronis says its use often indicated later-stage activity such as lateral movement or hands-on-keyboard control.
- MeshAgent generated 1,178 incidents from September 2025 through March 2026; the article also connects FlawedAmmyy to leaked Ammyy Admin source code.
- Acronis recommends minimizing concurrent remote access tools and investigating whether tools detected on endpoints are expected, rather than assuming their presence is legitimate.
Article Details
- Publisher
- Acronis
- Report Period
- January 2025–March 2026
- Scope
- Acronis telemetry on remote access and RMM tool installations, usage, and related EDR incidents in managed environments.
- Sample Size
- Nearly 1.8 million Acronis-managed endpoints; the EDR analysis also covered thousands of attacks involving RMM software.
- Key Statistics
- 63.1% of nearly 1.8 million managed endpoints had at least two remote access or RMM tools installed.
- RDP accounted for almost 26% of malicious EDR incidents involving remote access tools during January 2025–March 2026.
- MeshAgent generated 1,178 incidents between September 2025 and March 2026; Acronis says the increase reflects both greater attacker adoption and increased EDR deployment.
- MeshAgent generated almost eight times more malicious incidents than legitimate installations; Acronis cautions that the datasets are not perfectly correlated.
- Ammyy Admin generated almost 153 times more malicious incidents than legitimate installations; Acronis cautions that the datasets are not perfectly correlated.
- Recommendations
- Minimize the number of concurrently installed RMM and remote access tools.
- Inventory remote access tools across endpoints and remove those that are not needed.
- Lock down the remaining tools.
- Use EDR to distinguish expected RMM activity from attacker activity.
- Investigate and isolate endpoints when EDR flags MeshAgent; assess ConnectWise alerts against whether the endpoint is expected to have it installed.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article says attackers abuse RDP after initial compromise for remote administration, lateral movement, or hands-on-keyboard control.T1021.005 · VNCThe article identifies VNC/UltraVNC as a remote access method used by both IT teams and attackers.T1105 · Ingress Tool TransferThe article describes attackers installing commercially available RMM tools on victim machines as part of intrusions.T1219 · Remote Access ToolsThe article describes attackers using legitimate or open-source RMM tools on victim systems to maintain access and blend in with normal administration.
Threat Actors
AndarielAcronis says campaigns attributed to North Korean groups, including Andariel, have adopted MeshAgent.FIN11The article names FIN11 among financially motivated threat groups that used the FlawedAmmyy RAT; it presents TA505/FIN11 together without clarifying whether the names are aliases.TA505The article names TA505 among financially motivated threat groups that used the FlawedAmmyy RAT; it presents TA505/FIN11 together without clarifying whether the names are aliases.
Malware
Vendors
AcronisAcronis found that 63.1% of managed endpoints run multiple remote access or RMM tools, expanding attack surfaces and making IT environments harder to secure.AnyDesk#MeshAgentConnectWiseAttackers increasingly abuse legitimate or open-source tools such as MeshAgent, TeamViewer, ConnectWise ScreenConnect, and RDP to blend in with normal administration and spread across organizations.N-ableN-able RMM disclosed eight vulnerabilities, ConnectWise ScreenConnect added twoTeamViewerAttackers increasingly abuse legitimate or open-source tools such as MeshAgent, TeamViewer, ConnectWise ScreenConnect, and RDP to blend in with normal administration and spread across organizations.
Products
Acronis RMMtelemetry from over 1.8 million endpoints running Acronis RMM between JanuaryAmmyy AdminThe most abused tools in the data included MeshAgent, open-source VNC, Ammyy Admin, and built-in RDP.AnyDesk#MeshAgentConnectWise ScreenConnectAttackers increasingly abuse legitimate or open-source tools such as MeshAgent, TeamViewer, ConnectWise ScreenConnect, and RDP to blend in with normal administration and spread across organizations.MeshAgentAttackers increasingly abuse legitimate or open-source tools such as MeshAgent, TeamViewer, ConnectWise ScreenConnect, and RDP to blend in with normal administration and spread across organizations.MeshCentral[File names / tool names ] additional open-source or self-hosted tools mentioned in inventory and abuse context – RustDesk, MeshCentral, TacticalRMMRustDesk[File names / tool names ] additional open-source or self-hosted tools mentioned in inventory and abuse context – RustDesk, MeshCentral, TacticalRMMTacticalRMM[File names / tool names ] additional open-source or self-hosted tools mentioned in inventory and abuse context – RustDesk, MeshCentral, TacticalRMMTeamViewerAttackers increasingly abuse legitimate or open-source tools such as MeshAgent, TeamViewer, ConnectWise ScreenConnect, and RDP to blend in with normal administration and spread across organizations.UltraVNC[T1021.005 ] VNC – The article notes abuse of VNC/UltraVNC as a common remote access method used by both IT and attackers (‘VNC / UltraVNC’ and ‘open source VNC in the top 5’)