Security Guidance on RMM Abuse and Hardening Against Destructive Attacks
Security reporting and guidance highlighted how legitimate Remote Monitoring and Management (RMM) tools are increasingly being weaponized for intrusion and rapid ransomware deployment. Huntress data cited a 277% increase in RMM abuse in 2025, with attackers leveraging trusted, often pre-installed binaries to obtain hands-on-keyboard access that blends into normal IT activity; the reporting also noted that over half of suspicious Atera activity observed in cases reviewed was associated with ransomware, and that abuse of tools such as RustDesk or Atera can enable ransomware impact within 1–2 hours once access is established.
Separately, Google/Mandiant published defensive hardening recommendations focused on reducing the blast radius of destructive attacks (including ransomware) by protecting virtualization management planes (e.g., VMware vSphere/vCenter/ESXi and Microsoft Hyper-V). The guidance emphasizes defense-in-depth and Zero Trust network design—particularly isolating management interfaces into dedicated VLANs/segments and limiting administrative access paths—because management appliances may lack native MFA for local privileged accounts, making credential compromise a high-risk failure mode.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Report warns RMM tools are increasingly weaponized by attackers
Cyber Security News summarized industry findings that attackers are increasingly abusing RMM tools such as Atera and RustDesk for stealthy intrusion and rapid ransomware deployment. The article noted that phishing and social engineering often lead users to install rogue RMM agents, enabling hands-on-keyboard access and ransomware impact within one to two hours.
Google details hypervisor-level 'Disk Swap' theft technique
The Google Cloud guidance described a hypervisor-level 'Disk Swap' method in which an attacker detaches a domain controller's virtual disk, mounts it to another VM, and steals NTDS.dit with minimal guest-level artifacts. It recommended mitigations such as encrypting Tier 0 VMs and disks, removing orphaned VMs, and centralizing hypervisor audit logs.
Google publishes 2026 guidance on hardening against destructive attacks
Google Cloud published updated defensive guidance focused on protecting virtualization and backup infrastructure from destructive attacks. The guidance emphasized Zero Trust segmentation, PAW-only administration, restrictive egress controls, host-based firewalls, and stronger backup isolation and immutability.
Attackers use stolen RMM credentials to access an MSP environment
A Huntress SOC case study described attackers using stolen RMM credentials to enter a managed service provider environment, conduct enumeration, and attempt to disable the Huntress agent. The incident illustrated the potential for downstream impact across the MSP's customer base.
Huntress reports 277% increase in RMM abuse during 2025
The Huntress 2026 Cyber Threat Report said attacker abuse of remote monitoring and management tools rose 277% in 2025. The report highlighted that legitimate RMM binaries often blend in with normal administrative activity, making detection harder.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
RMM Tools Essential for IT Operations but Increasingly Weaponized by Attackers
cybersecuritynews.com
Open sourceProactive Preparation and Hardening Against Destructive Attacks: 2026 Edition | Google Cloud Blog
cloud.google.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers Abuse RMM Tools and Bomgar RCE to Breach MSPs and Deploy Ransomware
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Apr 30, 2026
Surge in Cyberattacks Leveraging RMM Tools for Malware Deployment
Cybercriminals have increasingly targeted remote monitoring and management (RMM) tools to deploy malware and conduct large-scale cyberattacks. In 2025, attacks on RMM tools surged, with 51 different solutions identified as targets by security researchers. RMM tools, which became more prevalent during the COVID-19 pandemic to support remote work, are now being weaponized by threat actors due to their deep integration into enterprise IT environments. These tools, such as SuperOps and TeamViewer, are commonly used by IT professionals and managed service providers (MSPs) to remotely monitor, manage, and maintain client systems through centralized dashboards. Adversaries exploit these platforms by obtaining authenticated credentials, allowing them to bypass traditional security alerts and alarms. Once inside, attackers can disable scheduled backups, destroy system images and restore points, and push ransomware or other malicious payloads to thousands of endpoints simultaneously. The legitimate appearance of RMM tool traffic often allows malicious activity to evade anomaly detection systems, creating a persistent blind spot for network defenders. The elevated permissions typically granted to RMM platforms enable attackers to escalate privileges, move laterally within networks, and deliver malware efficiently. Compromising an MSP’s RMM infrastructure can have a supply chain effect, enabling attackers to pivot into multiple client environments and significantly amplifying the potential impact. This method of attack not only increases the blast radius but also enhances the monetization opportunities for cybercriminals. Security experts warn that the widespread use and trust in RMM tools make them an attractive and effective vector for cyberattacks. Organizations are urged to implement stronger authentication, monitor RMM tool usage closely, and restrict access to minimize risk. The trend highlights the need for enhanced vigilance and updated security controls around remote access and management solutions. The attacks demonstrate how tools designed for convenience and efficiency can become significant liabilities if not properly secured. The ongoing exploitation of RMM tools underscores the evolving tactics of cybercriminals in targeting trusted IT infrastructure. As attackers continue to refine their methods, defenders must adapt by prioritizing the security of remote management platforms. The surge in RMM tool exploitation serves as a stark reminder of the importance of supply chain security and the risks posed by third-party service providers. Organizations should review their incident response plans to ensure rapid detection and containment of attacks involving RMM platforms. The cybersecurity community continues to monitor this threat landscape, emphasizing the critical need for proactive defense measures.
Mar 21, 2026
Threat Actors Expand Remote Monitoring and Management Abuse With Fake RMM Malware
Proofpoint reported a new **malware-as-a-service (MaaS)** offering that masquerades as a legitimate remote monitoring and management (RMM) product, branding itself as **TrustConnect** (delivered as “TrustConnect Agent”). Proofpoint assessed with *moderate confidence* that the actor behind TrustConnect was also a prominent user of **Redline stealer**, and said it worked with intelligence partners to disrupt parts of the malware’s infrastructure; the actor quickly showed resilience by standing up another fake RMM-themed site advertising a related malware variant called **DocConnect**. Proofpoint highlighted that attackers continue to favor RMM-style tooling for initial access and post-compromise control because it blends into normal enterprise remote support activity. Separately, Dark Reading summarized findings from Huntress’ 2026 Cyber Threat Report indicating a broad surge in **RMM abuse** as an intrusion strategy, citing a **277% year-over-year increase** in malicious RMM deployments and a corresponding decline in traditional malware usage. The report described RMM tooling as attractive to threat actors for stealth, persistence, and operational efficiency, and noted commonly abused products including **ConnectWise ScreenConnect**, **AnyDesk**, **Atera**, **NetSupport**, **PDQ Connect**, and **Splashtop**, with healthcare and technology seeing the largest increases. Together, the reporting underscores both the industrialization of RMM abuse and the emergence of purpose-built “fake RMM” malware offerings designed to look like enterprise remote support software.
Mar 21, 2026