Threat Intel
RMM Abuse Surge: Threat Actors Use Daisy‑Chain RMM Tools for Initial Access, Persistence, and Detection Evasion
Cybercriminals are increasingly exploiting remote monitoring and management (RMM) platforms to gain footholds, maintain persistence, and evade detection. Defenders should audit RMM permissions, enforce least‑privilege, monitor for anomalous RMM activity, and segment RMM traffic. Immediate action can prevent lateral movement and data exfiltration.
What Happened
Recent threat‑intel reports show attackers leveraging commercial RMM solutions—such as ConnectWise Automate, SolarWinds RMM, and NinjaRMM—to establish footholds in target networks. By chaining multiple RMM instances, adversaries can move laterally, maintain persistence, and sidestep traditional detection mechanisms.
Impact
RMM abuse can lead to unauthorized remote access, credential theft, and stealthy data exfiltration. Attackers often use compromised RMM agents as pivot points, allowing them to bypass network segmentation and endpoint detection systems.
What Defenders Should Do
- Conduct a comprehensive inventory of all RMM deployments and associated credentials.
- Enforce least‑privilege and MFA for all RMM accounts.
- Monitor RMM logs for anomalous activity, such as unexpected script execution or new agent registrations.
Mitigation Checklist
- Restrict RMM agent installation to approved devices only.
- Segment RMM traffic and apply firewall rules to limit outbound connections.
- Implement continuous monitoring of RMM command and control channels.
- Regularly patch RMM software and associated endpoints.
- Educate staff on phishing vectors that can compromise RMM credentials.
“RMM abuse is the new vector for initial access.”
Related articles
Bomgar RMM Compromise Surge: Immediate Defensive Actions
Huntress SOC reports a spike in attacks targeting Bomgar RMM instances. Defenders should verify patch status, enforce MFA, isolate compromised endpoints, and monitor for lateral movement. Immediate remediation can limit attacker persistence.
Read briefing
Browser‑in‑the‑Browser Phishing Enables Rogue ScreenConnect Persistence
Attackers used a phishing campaign that delivered a browser‑in‑the‑browser (BIB) page, enabling installation of a rogue ScreenConnect remote‑management module that persisted on victim endpoints. The technique bypassed standard endpoint detection and allowed stealthy lateral movement. Defenders should block BIB URLs, audit ScreenConnect processes, and enforce MFA on RMM tools.
Read briefing
DecryptAds: New Service Maps Adtech Ecosystem for Security Teams
DecryptAds scrapes ads.txt, app‑ads.txt, buyers.json, and sellers.json from sites and apps to build a comprehensive view of who can serve ads or collect data. Security teams can use the data to spot malicious ad networks, adversarial actors, and supply‑chain gaps. The service is free and designed for privacy‑focused threat hunting.
Read briefing
Detecting Cobalt Strike Beacons with Elastic Stack: Memory‑Based Collection and Analysis
Cobalt Strike, a popular red‑team tool, can be abused by threat actors to maintain persistence via malleable C2 beacons. Using Elastic Stack’s Fleet policy, defenders can capture shellcode and memory regions from Windows endpoints, parse beacon configurations, and surface adversary activity. The following briefing explains how to set up detection‑only policies, collect 4 MB memory samples, and analyze beacon metadata.
Read briefing