Image: cdn.builder.io · rights & removal

Rogue RMM Abuse: How Attackers Exploit Remote Access Tools

Reporting by Huntress LabsRead the original at huntress.com

Executive Summary

Attackers are exploiting the trust placed in legitimate IT tools, specifically Remote Monitoring and Management (RMM) software, to gain persistent access after initial phishing attacks. In several investigations, attackers used lures, such as seemingly innocuous documents or emails mentioning ScreenConnect, to trick employees into installing malicious remote access clients. This process allows attackers to establish multiple, redundant persistence paths by installing not only an initial RMM client but also secondary tools like ScreenConnect onto compromised devices. Because RMM tools are legitimate business necessities, a rogue installation blends in with normal IT activity, making detection difficult using only telemetry. The presence of multiple rogue agents complicates response efforts because removing one piece of access does not eliminate other established routes back into the environment.

Facts Only

* A secure-document lure hid the installation of a remote monitoring and management (RMM) tool in one investigation.
* An employee opened a file that led to the installation of an attacker's remote monitoring and management (RMM) tool, followed by a ScreenConnect session for persistent access.
* Phishing emails mentioned ScreenConnect by name, leading victims to expect viewing a document rather than installing a remote access client.
* Attackers used trusted RMM tools to gain initial access via phishing, establishing malicious remote access.
* Attackers added more rogue RMM clients to create redundant and persistent paths back into the environment.
* A recent incident involved an attacker using an undetected ScreenConnect client installed five months prior to access a user's browser and configure malicious inbox rules.
* An attack flow involved a lure that installed two rogue RMMs, including ITarian and ScreenConnect, with persistence at the SYSTEM level.
* A phishing campaign used links leading to an Adobe InDesign-hosted lure page impersonating a document share to redirect users to attacker-controlled infrastructure.
* The lure PDF was crafted to trick employees into installing a rogue instance of ITarian via an embedded link in a ZIP file hosted on a cloud storage site.
* Subsequent incidents involved a phishing email that appeared to be a document share "via ScreenConnect," leading to the deployment of malicious payloads and additional RMM installations.

Full Take

The narrative highlights a systemic vulnerability where the perceived legitimacy of essential business tools becomes an amplifier for compromise. Attackers are shifting tactics from relying solely on novel exploits to weaponizing established operational trust, turning standard IT workflows into backdoors. The proliferation of legitimate remote management tools creates an environment where detection is reliant not just on identifying malicious binaries but on understanding contextual anomaly—determining if a seemingly normal installation or session belongs within the approved operational context.
The core pattern observed is the stacking of access paths: initial phishing grants entry, and then the use of legitimate RMM infrastructure allows for layered persistence. This challenges the assumption that an isolated compromise can be solved by removing a single artifact. The fact that attackers leverage identical tooling creates a layer of camouflage, as telemetry alone cannot distinguish between authorized management activity and malicious remote access. This demands a shift in defensive focus from signature-based detection to context-aware inventory and anomaly hunting across all legitimate system processes.
The implication for human agency is the erosion of trust in the security perimeter itself; if trusted tools are compromised or abused, the very mechanisms meant for protection become the vectors for persistence. The focus must move toward a proactive state of inventory verification—knowing every deployed RMM client's context and approval status—rather than merely reacting to malware signatures. This necessitates establishing protocols that treat the presence of unauthorized legitimate software not as an error, but as evidence of a sophisticated, layered intrusion strategy, demanding a complete review of established trust boundaries within the environment.
Bridge Questions:
How can security architectures be designed to verify the context and provenance of RMM installations in real-time rather than relying on static approval lists? What adaptive response strategies can be implemented when multiple seemingly legitimate tools are observed operating concurrently on an endpoint? What organizational changes are required to shift the focus from blocking known threats to assessing the integrity of established operational trust?

From the original · Huntress Labs

Attackers are increasingly turning to trusted software your business already depends on instead of custom malware or exploits. In one recent Huntress Security Operations Center (SOC) investigation, a secure-document lure hid the installation of a remote monitoring and management (RMM) tool.

Read the full story at huntress.com

Sentinel — Human

Confidence

The text reads like an investigative security report synthesizing specific threat examples into a generalized pattern regarding Remote Monitoring and Management (RMM) abuse, suggesting human journalistic synthesis of forensic findings.

Signals Detected

Sentence length variance shows some variation, though the prose is dense and action-oriented; not perfectly uniform.

The text flows logically from a specific incident to a broader pattern and then to a call for action. It maintains focus on the central theme (RMM abuse).

Uses direct reporting of findings ('our SOC investigated', 'we tracked') alongside general threat analysis, suggesting a journalistic structure.

References to specific spikes (277% spike in 2025) and specific tool names suggest grounded reporting, though the context of the figures requires external verification.

Human Indicators

Use of specific case investigation details (Huntress SOC investigations, explicit threat actor nomenclature like ITarian/ScreenConnect) suggests an investigative source base.

The inclusion of conceptual figures (Figure 1, Figure 2) points toward a structure typical of security reporting.

The concluding call to action ('Know every RMM in your environment') transitions smoothly from evidence to practical advice.