Huntress 2026 Threat Report Finds RMM Abuse Rose 277% in 2025
Report discovered via Awesome Annual Security Reports.
Summary
Huntress reports a 277% rise in remote management tool abuse in 2025, while ClickFix represented 53.2% of observed loader activity. Its annual report highlights credential-driven intrusions and ransomware operators prioritizing stealth and data theft.
Key points
- The report analyzes 2025 activity drawn from more than 4.6 million endpoints and 9.4 million identities protected by Huntress; its findings reflect that monitored population.
- RMM abuse increased 277% year over year and accounted for 24% of observed incidents. Attackers used legitimate management agents for command execution, persistence, lateral movement, and redundant access.
- ClickFix represented 53.2% of observed malware loader activity, followed by SocGholish at 24.1%. These delivery methods exploit user trust through manual command execution and fake software updates.
- Ransomware accounted for 5% of observed incidents, with volume increasing year over year. Akira, RansomHub, Qilin, and Medusa collectively represented approximately 51% of ransomware incidents.
- Average time from initial access to ransomware deployment increased from 17 to 20 hours. Huntress attributes the change partly to data theft, operational handoffs, and stealthier preparation.
- Healthcare represented 21% of observed incidents, manufacturing 17%, and education 16%. Healthcare overtook education as the most targeted industry in Huntress telemetry.
- Identity intrusions combined stolen credentials, AiTM phishing, session hijacking, OAuth abuse, and mailbox persistence. Huntress recommends monitoring post-login behavior and correlating suspicious RMM activity with adjacent malicious actions.
Article Details
- Publisher
- Huntress
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Endpoint, identity, ransomware, remote management abuse, exploitation, phishing, and AI-assisted threats observed through Huntress telemetry.
- Sample Size
- Analysis drawn from over 4.6 million endpoints and 9.4 million identities; incident and phishing-email sample counts not disclosed.
- Key Statistics
- RMM abuse increased 277% year over year and accounted for 24% of incidents observed by Huntress in 2025.
- ClickFix represented 53.2% of observed malware loader executions in 2025.
- Ransomware accounted for 5% of observed incidents in 2025; its overall volume increased year over year.
- Average time from initial access to ransomware deployment increased from approximately 17 hours in 2024 to 20 hours in 2025.
- Access policy and trust boundary violations accounted for 37.2% of 2025 ITDR incidents, followed by mailbox manipulation and persistence at 19.0% and adversary-in-the-middle activity at 18.9%.
- Recommendations
- Treat unexpected RMM installations as high-confidence compromise signals; maintain an approved inventory and require approval workflows and device validation for new agent enrollment.
- Enforce MFA on VPNs, administrative interfaces, RMM platforms, and backup consoles.
- Apply security patches and regularly review logs for unauthorized RMM activity.
- Restrict lateral movement through network segmentation and least privilege, and monitor WinRM, RDP, and service account usage.
- Capture interpreter command lines and script block logs, monitor post-login behavior, and routinely audit mailbox rules, including hidden rules.
MITRE ATT&CK
T1003.003 · NTDSRansomware operators extracted domain credential material from offline NTDS.dit copies accessed through Volume Shadow Copies.T1027 · Obfuscated Files or InformationOperators used encoded PowerShell, string concatenation, split keywords, and adaptive decoding chains to evade detection.T1059.001 · PowerShellPowerShell downloaders retrieved ransomware payloads, and remote PowerShell sessions supported discovery, deployment, and security configuration changes.T1078 · Valid AccountsAttackers logged in with stolen or purchased valid credentials to compromise environments and identities.T1114.003 · Email Forwarding RuleAttackers configured mailbox rules to forward sensitive emails externally after establishing access.T1204 · User ExecutionClickFix and fake CAPTCHA lures instructed users to manually execute malicious commands.T1219 · Remote Access ToolsAttackers abused legitimate RMM agents for persistent interactive access, command execution, file transfers, and lateral movement.T1486 · Data Encrypted for ImpactObserved ransomware intrusion chains culminated in deployment or attempted deployment of file-encrypting payloads.T1490 · Inhibit System RecoveryRansomware groups used standardized commands to remove shadow copies before deployment.T1539 · Steal Web Session CookieAiTM attacks stole authentication session tokens to bypass MFA and enable subsequent account abuse.T1550.002 · Pass the HashOperators reused stolen password hashes through pass-the-hash to authenticate and move laterally.T1550.003 · Pass the TicketOperators reused captured Kerberos tickets through pass-the-ticket for access across the network.T1558.003 · KerberoastingOperators performed Kerberoasting against service accounts after obtaining domain credential material.T1562.001 · Disable or Modify ToolsAttackers weakened Defender settings, introduced exclusions, and used vulnerable kernel drivers to impair endpoint defenses.T1572 · Protocol TunnelingRansomware operators used encrypted tunnels including cloudflared, ngrok, FRP, and Chisel for staging and data theft.
CVE
CVE-2024-40766actors targeting an improper access control flaw (CVE-2024-40766) inCVE-2025-0108by auto-forwarding or deleting messages) to expand their reach into your public disclosure of CVE-2025-0108 on February 12, an authentication bypass inCVE-2025-11371unauthenticated CentreStack and Triofox Local File Inclusion flaw (CVE-2025-11371).CVE-2025-14611CVE-2025-14611. Because the AES implementation in Gladinet’s CentreStack andCVE-2025-30406Figure 31: Screenshot of CISA’s Notification of CVE-2025-30406CVE-2025-31161flaw (CVE-2025-31161) in CrushFTP software. This vulnerability impactedCVE-2025-48983attacks on the Mount Service (CVE-2025-48983), the SVC_VEEAMCVE-2025-55182Threat actors broadly targeted CVE-2025-55182 due to its widespread Figure 33: Post-exploitation stage of React2Shell attack path
People
Casey SmithStaff Threat Intelligence Analyst, recommended known-login-location allow lists to improve resilience against BEC.Eric StrideChief Information Security Officer, Huntress, quoted on prioritizing meaningful signals and rapid response.Jamie LevySenior Director, Adversary Tactics, described observed attacker use of AI for coding, automation, and phishing.Kyle HanslovanCEO and Cofounder of Huntress, quoted on the business-like organization of cybercrime.Robert KnappDirector, Security Operations Center, quoted on attackers replacing custom C2 malware with legitimate RMM solutions.
Threat Actors
AkiraLeading observed ransomware operator; associated with SonicWall SSLVPN exploitation and credential theft.BlacksuitFormerly named Royal; reportedly dismantled in July following a global law enforcement takedown.BlueNoroffIdentified as a North Korean APT group that used leadership deepfakes during a Zoom call to induce malware installation.Cl0pDescribed as specializing in exploit-driven operations and linked by the report to December Gladinet exploitation.DragonForceReportedly attempted to build a ransomware cartel with Qilin and LockBit and used early security-control reconnaissance and tampering.LockBitUsed encrypted tunnels for data theft and resurfaced with LockBit 5.0 despite law enforcement disruptions.MedusaOne of four groups accounting for over half of observed ransomware incidents; used security tampering and encrypted tunneling.QilinOne of the four dominant ransomware groups; reportedly involved in DragonForce's attempted ransomware cartel.RansomHubOne of the dominant ransomware groups; the report states DragonForce was formed by former members.RoyalIdentified by the report as the former name of BlackSuit.
Malware
AsyncRATAsyncRAT is the most prominent catalyst for these handoffs, with one-third of ransomware activity happening within minutes of installation, a clear sign of immediate monetization.Atomic macOS Stealer (AMOS)In December, we saw a particularly novel tactic in an AMOS stealerGootloader- **Gootloader**: 3.0%PeerBlightcalled ‘PeerBlight’, a reverse-proxy tunneling tool nicknamedQakbot- **QakBot**: 2.8%Remcossignal different behaviors: Jupyter RAT often indicates methodical "hands-on-keyboard" activity, while Remcos is typically deployed after gaining privileged privileges near the end of an operation.SocGholish- **SocGholish**: 24.1%StrRatCertain families—specifically RevengeRAT, STRRAT, and XWorm—are precursors to imminent ransomware activity and require the same immediate response as the ransomware itself.XWormCertain families—specifically RevengeRAT, STRRAT, and XWorm—are precursors to imminent ransomware activity and require the same immediate response as the ransomware itself.ZinFoqCowTunnel, and a Go-based implant dubbed ZinFoq. We also watched
Vendors
GladinetGladinet had a spicy security year. We responded to multiple exploitedMicrosoftFor those unfamiliar with NTDS.dit, it’s the main database file for Microsoft Active Directory Domain Services (AD DS).Palo Alto Networksbusiness. the management web interface of Palo Alto Networks PAN-OS software. TheSonicWallSpecific surges were occasionally tied to exploits, like Akira’s August campaign targeting SonicWall SSLVPN devices, but these became the exception and not the norm.VeeamVeeam Backup
Products
CrushFTPflaw (CVE-2025-31161) in CrushFTP software. This vulnerability impactedGladinet CentreStackvulnerabilities, including a critical severity flaw, in Gladinet’s CentreStack andMicrosoft 365 Apps for EnterpriseThreat actors continued to exploit Microsoft 365 environments, but in 2025,Microsoft Defender Antimalware Platformused to tamper with or disable Microsoft DefenderNext.jsnature (the components are used in React.js, Next.js, and more) and thePAN-OSbusiness. the management web interface of Palo Alto Networks PAN-OS software. TheReact.jsnature (the components are used in React.js, Next.js, and more) and theScreenConnectwith larger, traditional RMM platforms, suggesting a multi-stage operation or a change in ownership. ScreenConnect and SimpleHelp have the longest dwell times, ranging from 18 to 32 hours, with SimpleHelp showingSonicWall SSL VPNSpecific surges were occasionally tied to exploits, like Akira’s August campaign targeting SonicWall SSLVPN devices, but these became the exception and not the norm.
Tools
Atomic Red Team- **Atomic Red Team**: 21.7%Chisel- Mass adoption of encrypted tunnels such as `cloudflared`, `ngrok`, `FRP`, and `Chisel` to conduct staging and steal files, especially in more professional groupsCobalt Strike- EDR’s Managed AV Shut Down ➔ Cobalt StrikeCowTunnelCowTunnel, and a Go-based implant dubbed ZinFoq. We also watchedEvilginxFigure 51: An example of an AiTM attack with EvilginxEvilProxytools like Evilproxy or Evilginx. These attacks to stealthier tactics like validFRP- Mass adoption of encrypted tunnels such as `cloudflared`, `ngrok`, `FRP`, and `Chisel` to conduct staging and steal files, especially in more professional groupsImpacketIt’s a known strategy, but this year, we saw it used by several small ransomware groups who had been using `ntsdutil`, `impacket`, `reg save`, or similar easily detected methods to carry out these attacks.Mimikatz- **Mimikatz**: 28.0%RCloneFor data theft, `Rclone` was still the most consistent and scalable exfiltration utility, especially during late summer and fall as campaigns shifted toward bulk data theft and extortion.
Countries
Industries
EducationThroughout 2024, attackers targeted a wide range of industries, with a focus on education and healthcare.GovernmentBeyond these industries, the technology and government sectors also saw major cyber incidents.HealthcareThroughout 2024, attackers targeted a wide range of industries, with a focus on education and healthcare.ManufacturingAt the same time, the manufacturing industry became a new focus for attackers, accounting for 17% of observed incidents in 2025.TechnologyBeyond these industries, the technology and government sectors also saw major cyber incidents.