RMM Abuse Surged 277% as Attackers Exploit Trusted Remote Access Tools
Summary
Huntress reports a 277% rise in RMM abuse, with attackers using legitimate remote access tools for stealthy access. It recommends tracking authorized tools, enabling MFA, and strengthening user awareness and endpoint defenses.
Key points
- Huntress says RMM abuse rose 277% last year and appears in nearly 40% of incidents its Tactical Response team investigates.
- Attackers use legitimate remote access tools to blend in with routine IT activity and may trick users into installing them through social engineering.
- In one example, a rogue ScreenConnect installation sat unused for five months before being used to access a browser, create inbox rules, and send spam from the victim’s account.
- Approved and rogue RMM installations can look alike in process and network telemetry, making an up-to-date inventory of authorized tools and endpoints important.
- Huntress says its RMM Guard capability inventories RMM tools and blocks installations that are not explicitly authorized.
- The article recommends verifying MFA coverage, improving phishing-awareness practices, and preparing to contain compromised devices.
Article Details
- Defense Focus
- Identify and control unauthorized remote monitoring and management (RMM) installations by maintaining an authorized inventory and validating whether each installation belongs in the environment.
- Detection Methods
- Inventory RMM software across endpoints and compare installations against an explicitly authorized list.
- Correlate installation context, process trees, and network connections, while recognizing that these signals alone may not distinguish rogue from approved RMM use.
- Investigate suspicious activity associated with RMM use, including browser access, inbox-rule creation, and spam sent from a user's account.
- Data Sources
- Endpoint software and RMM inventory
- Process trees and process-launch context
- Network traffic and connection destinations
- Identity Threat Detection and Response alerts
- Email and inbox-rule activity
- Platforms
- Windows endpoints
- Defensive Actions
- Maintain a current inventory of approved RMM tools and specify which endpoints may run them.
- Block RMM installations that are not explicitly authorized.
- Remove RMM software that is not needed.
- Verify that MFA is enabled wherever required, including VPN access.
- Train users to report phishing attempts and suspicious remote-support requests.
- Restrict execution of binaries from Downloads folders and ensure compromised machines can be contained promptly.
MITRE ATT&CK
T1114.003 · Email Forwarding RuleAfter accessing a victim's browser, the attacker set up inbox rules.T1219 · Remote Access ToolsAttackers used rogue ScreenConnect and other remote access tools to obtain and maintain remote access.T1566.002 · Spearphishing LinkA user clicked a ScreenConnect lure delivered through a link, and a fake recruiter email asked a recipient to download a meeting app that was a cracked RMM.T1583.001 · DomainsCracked, self-hosted ScreenConnect instances were resold as branded subdomains for use by scam call centers.
People
Vendors
AnyDeskSenior Manager of Tactical Response at Huntress, and Matt Caldwell, Director of Fraud Prevention at AnyDesk, unpacked during the Trusted Tools in Untrusted Hands: RMM Abuse Hiding in Plain Sight live event: whyHuntressRMM abuse jumped 277% last year because attackers use trusted remote access tools to blend into normal IT activity. Huntress Tactical Response now sees it in nearly 40% of the incidents it investigates.Netcraftcracked, self-hosted ScreenConnect instances that were being resold as branded subdomains. Working with Netcraft to take down those domains disrupted every call center relying on that infrastructure for days.
Products
PowerShellwith a victim. Before any money moved, the team used its access to shut down the scammers' dialer with PowerShell and call the victim directly.RMM GuardRMM Guard is a new Huntress application-control capability that helps with this.ScreenConnectOne ScreenConnect install went unused for five months, then led to browser access, malicious inbox rules, and spam sent from the victim's own account.VPNyou think it is. One gap is enough. As Dray states, roughly 70% of advanced attackers get in through the VPN, with credentials stolen elsewhere, often from a personal device.