Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice
Essential information
- Published
- 12/03/2025 16:00
- Modified
- 12/03/2025 16:31
- Tags
- 2025-03-12 astaroth asyncrat atera bluetrait cybercrime email campaigns fleetdeck grandoreiro guildma initial access lumma stealer mispadu netsupport remcos remote access rmm screenconnect
- Related entities
- 15 observables, 19 techniques (mitre), 12 malware, 11 others
Description
Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft, lateral movement, and installing additional malware. Notable RMM tools observed in campaigns include ScreenConnect, Fleetdeck, and Atera. The shift towards RMM usage coincides with law enforcement disruptions of major malware families and a decline in ransomware payments. Specific threat actors like TA583 and TA2725 have been observed incorporating RMMs into their attack strategies. Organizations are advised to restrict unauthorized RMM installations, implement network detections, and train users to identify suspicious activity.