How RMM abuse gives attackers a way in that looks like business as usual

Attackers are utilizing legitimate Remote Monitoring and Management (RMM) software in 45% of endpoint-related incidents recorded in the first quarter of 2026. Attackers leverage RMM tools, which IT teams use for management, to gain persistent access and remote command execution that appears as normal administrator activity. This abuse is categorized as one hop from ransomware or data theft and has seen a 277% year-over-year increase in 2025. Attackers can use malicious copies alongside approved versions to achieve similar outcomes. Furthermore, mailbox manipulation accounts for 19% of identity-based threats and 24.6% of identity threat signals so far in 2026. Adversary-in-the-middle (AiTM) takeovers involve session token theft, allowing attackers to maintain a signed-in state without needing passwords or MFA prompts. Device code phishing shows a 1,380% year-over-year increase in related activity.

The integration of legitimate enterprise tools into the attack surface represents a significant shift from purely malicious tool usage to leveraging established trust relationships. The ease with which attackers can embed themselves within RMM frameworks exploits organizational reliance on administrative workflows, effectively weaponizing the concept of "business as usual." This pattern suggests that security defenses must evolve beyond signature-based detection to scrutinize the context and behavior inherent in legitimate system activities. Simultaneously, the observed manipulation of identity layers through session token theft and mailbox rule changes highlights a systemic vulnerability where authentication mechanisms are bypassed by exploiting established trust sessions rather than credential compromise alone. The growth in AI-assisted delivery, evidenced by fake artifacts leveraging real platform domains, implies that the sophistication of delivery is accelerating faster than traditional defensive frameworks can adapt. The key implication for agency is the necessity to establish verification protocols not just around external access points but within the operational integrity of core management systems, prompting questions about where accountability resides when tools designed for legitimate oversight become vectors for compromise. What measures are in place to verify the provenance and intent behind all remote management commands? How can security postures be assessed when the threat vector is woven into accepted administrative functions?