RMM Abuse Rose 277% in 2025 as Attackers Exploited Trusted Remote-Management Tools
Summary
Huntress reports RMM abuse rose 277% in 2025. Attackers use phishing or stolen credentials to gain access through legitimate tools; Huntress recommends baselining activity, fingerprinting approved tools, and monitoring anomalies.
Key points
- Huntress’s 2026 Cyber Threat Report reports a 277% rise in RMM abuse in 2025.
- Attackers may trick users into installing rogue RMM agents or use stolen RMM credentials to gain access through legitimate software.
- A Huntress SOC case involved enumeration commands and an attempt to disable its agent; the threat was contained about 12 minutes after the first command.
- Huntress says more than 50% of cases following suspicious Atera activity were linked to ransomware attacks.
- Recommended defenses include baselining normal RMM use, monitoring unusual users, times, and behavior, and fingerprinting approved tools, executable hashes, and expected connections.
- The article also recommends reviewing remote-access software and logs, applying basic controls, and training employees to recognize social engineering.
Article Details
- Defense Focus
- Detect and contain unauthorized or anomalous use of remote monitoring and management (RMM) tools, rather than trusting them solely because they are approved or legitimate.
- Detection Methods
- Establish baselines for which users access each RMM tool and when; investigate unusual users, timing, or behavior, such as command-line scripts run through an RMM tool at 3 a.m.
- Maintain a detailed inventory and fingerprints of approved RMM tools, including executable hashes and expected connection destinations; alert on mismatches or unknown servers.
- Verify unfamiliar RMM tools and configurations, review their logs, and validate connection endpoints to determine whether activity is legitimate or malicious.
- Monitor for suspicious RMM activity and attempts to disable the Huntress agent.
- Data Sources
- RMM usage and session activity, including user identity, access times, and behavior
- Approved-tool inventory, executable hashes, and expected connection URLs or IP addresses
- RMM configuration and logs, including connection endpoints
- Endpoint activity, including command execution and attempts to uninstall or disable the Huntress agent
- Platforms
- RMM environments
- Managed service provider (MSP) environments
- Defensive Actions
- Restrict remote access, including locking down Remote Desktop.
- Monitor which remote access software is present and how it is used.
- Investigate tools that are not approved or whose fingerprints or connection destinations do not match the allow list.
- Apply security awareness training and encourage staff to report suspicious behavior.
- Review and strengthen common security controls; coordinate with RMM vendors on abuse detection and removal of malicious instances.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe article describes an example of an anomalous user running command-line scripts through an RMM tool and reports enumeration commands in an intrusion.T1219 · Remote Access ToolsThreat actors abuse legitimate RMM software, including Atera, RustDesk, and ScreenConnect, for interactive remote access.T1562.001 · Disable or Modify ToolsIn a reported incident, the threat actor attempted to disable the Huntress agent.T1566 · PhishingThe article describes phishing and social engineering lures that prompt users to download or execute a file installing an RMM agent.
Vendors
Products
AnyDeskAttackers love your RMM tools as much as you do. Watch Huntress and AnyDesk break down how RMM abuse actually works, how attackers turn trusted tools into a path to ransomware, and how you can close that gap.AteraThe Huntress 2026 Cyber Threat Report findings show that over 50% of cases following suspicious Atera RMM activity are directly linked to ransomware attacks.RustDeskWhen tools like RustDesk or Atera are abused, ransomware damage can unfold in as little as an hour or two, according to the Huntress 2026 Cyber Threat Report.ScreenConnectIt’s not enough to know that you “use ScreenConnect.” You need an ongoing, detailed inventory of your attack surface.