Huntress Report Highlights Abuse of RMM Tools and Cloud Storage
Summary
Huntress says its 2023 observations show attackers abusing legitimate tools for remote access and malware delivery or data exfiltration; 36% of malicious remote-access tools were RMM tools, and nearly 80% of cloud-storage misuse incidents involved OneDrive.
Key points
- The article summarizes trends Huntress observed in 2023 using data from millions of endpoints and user entities.
- Huntress says RMM tools accounted for 36% of tools used for malicious remote access, with ScreenConnect and Atera among the examples.
- Nearly 80% of cloud-storage misuse incidents observed by Huntress involved OneDrive; services such as OneDrive, Google, and Dropbox were used to distribute malware or exfiltrate data.
Article Details
- Event Type
- Publication of Huntress's 2024 Cyber Threat Report findings on cybercriminals abusing legitimate tools and services to gain remote access, distribute malware, and exfiltrate data.
- Impact
- Huntress reports that remote access abuse occurred on tools including ScreenConnect and Atera, and that RMM tools accounted for 36% of tools leveraged for malicious remote access. Nearly 80% of cloud storage misuse incidents in 2023 involved OneDrive. The article describes these services as being abused for malware distribution or data exfiltration; it does not identify specific incidents, victims, or direct losses.
Vendors
Products
Ateraobserved throughout 2023, with remote access abuse occurring on popular tools like ScreenConnect and Atera. In fact, 36% of tools leveraged for malicious remote access were RMM tools that many organizations relyDropbox DocSendThis is just one example of ways in which cybercriminals leveraged services like OneDrive, Google, or Dropbox to distribute malware or exfiltrate the data that helps them make money.GoogleOneDrive. This is just one example of ways in which cybercriminals leveraged services like OneDrive, Google, or Dropbox to distribute malware or exfiltrate the data that helps them make money.Microsoft OneDriveand, of course, more lucrative exploits. In 2023, nearly 80% of cloud storage misuse incidents involved OneDrive. This is just one example of ways in which cybercriminals leveraged services like OneDrive, Google, orScreenConnecta pattern Huntress observed throughout 2023, with remote access abuse occurring on popular tools like ScreenConnect and Atera. In fact, 36% of tools leveraged for malicious remote access were RMM tools that many