Huntress Details How Attackers Chain RMM Tools for Persistent Access and Credential Theft

Mar 11, 2026 · Original article ↗

Summary

Huntress analyzes campaigns using phishing lures and chained RMM tools to gain access, steal credentials, and complicate detection. It reports RMM abuse accounted for 24% of observed incidents and rose 277% last year.

Key points

Huntress says RMM abuse accounted for nearly a quarter of its observed incidents last year, increasing 277% over the prior year.
Investigated campaigns used invitation- and Social Security-themed lures, search poisoning, and phishing pages to deliver rogue RMM installers.
Attackers chained tools such as Action1 and ScreenConnect to establish remote access, fragment telemetry, and complicate investigation and containment.
Some LLM-generated infostealer scripts collected browser-history references to financial services but did not implement the Telegram exfiltration described in their comments.
In observed post-access activity, a fake Windows Security prompt solicited users' PINs and saved entered values in plaintext; other activity targeted email accounts and banking portals.
Huntress recommends scrutinizing unapproved RMM deployments, allow-listing approved tools, improving platform logging, and monitoring suspicious trial usage.

Article Details

Attack Vectors: Email and search-engine-poisoning lures led victims to invitation- or document-themed downloads that installed rogue RMM clients.
Threat actors chained RMM and deployment tools, including Action1 and WScript, to install ScreenConnect clients for persistent remote access.
Phishing pages hosted in abused GitHub repositories used browser-native download methods to deliver MSI installers.
A separate mobile-only campaign presented a greeting card and prompted victims to sign in to an email provider to harvest credentials.
A .NET executable impersonated Windows Security, repeatedly prompted users for their Windows login PIN, and saved entered values to plaintext.
Threat actors used Hotmail combo lists to access victim email accounts, then attempted to access associated banking portals.
Defensive Notes: Explicitly allow-list approved RMM tools and scrutinize unrecognized deployments, particularly those launched from user-writable paths, email-delivered installers, or trial-based deployments.
Treat RMM installation as a security-relevant event and review installer prevalence, deployment history, audit logs, and parent-child process relationships.
Use stronger identity verification, tighter deployment limits, and monitoring for anomalous activity in RMM trial and free-tier accounts.
Share recurring lure themes, delivery paths, and RMM daisy-chain behaviors, since filenames, hashes, and infrastructure change.

Indicators of compromise

Type	Indicator	Context
IPV4	`105[.]113[.]63[.]173`	Source IP listed in logon activity observed on the threat actor's server.
IPV4	`209[.]160[.]115[.]150`	Source IP listed in logon activity observed on the threat actor's server.
IPV4	`93[.]152[.]214[.]210`	Source IP listed in logon activity observed on the threat actor's server.
IPV4	`98[.]97[.]79[.]68`	Source IP listed in logon activity observed on the threat actor's server.
SHA256	`1a0769b8445cc27e2ddcdcee9a85a072c2be729e254f6c732548b0fb2bdfe0ef`	Hash listed for hide_from_cp.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`22006710eaad12c4da19edaee4cb6fdd3c3face7e16bbcbd9e4f83eed7f3e7de`	Hash listed for EnablePowerOptions.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`27c489d5239a3a25f51119b45b7be1ae8a38a153d708f983837d3c602bd367f8`	Hash listed for hide_mouse.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`429cbc557b1a9c8ceddab06b12b0fc3fc03c2908bb9ccd5ec8d2b386ccdb679a`	Hash listed for disable_task_manager.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`42ef97c8260f9f287ead7b978378de2f27056f23dc513de5f36819159bfe5ebe`	Hash listed for disable_control_panel.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a`	Hash listed for phonepc.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc`	Hash listed for HideFromControlPanel.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`79f25a73e056ecb8aebf36c593ad1826cefa31346a2feca1ba3ed395453c9c48`	Hash listed for toolbox.rar, an artifact found in the threat actor's administrator documents directory.
SHA256	`83a8c175cdab60d043759ea04d62ac10a147d0b00e7a610f35e4939873416adc`	Hash listed for disable_cmd.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657`	Hash listed for PIN (1).exe among the artifacts associated with the threat actor's toolbox.
SHA256	`ae5afb20bc1455322c089eed22c81facb19195ed816bb52b0f405a62fd92dda7`	Hash listed for WebBrowserPassView.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`b775f42c9d280b115ac0aeb168186583f93d94a19a29b7fac8c5e2c98c986bdd`	Hash listed for phone_link.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`bfa9c3298a749c8949f890ef02b4d07589bea1635150d57215b2f37b6f3acef0`	Hash listed for Windows Defender DAC.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`ca9ac952feaaa5cbbbdea15716ee2acd3b1072f01156b5d2fb35066703de6955`	Hash listed for DisablePowerOptions.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`ebc81a8f91d9b18c7d642bfdcf5f8e26d8921d4501e44e1603c0b67666d8c3e1`	Hash listed for no_power_off.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`ec2bdcd616d9dcfbb9bff53d9649c4456823b7384aef65ad1838b5a9fc69e879`	Hash listed for EnableTaskManager.exe among the artifacts associated with the threat actor's toolbox.
SHA256	`f2c0c09f4871621ce6dc0cc98dbeba596f08453dd6bdc1f001f26449b1eddfb3`	Hash listed for Password.exe among the artifacts associated with the threat actor's toolbox.