Attackers Hijack Trusted RMM Tools to Create Invisible, Permanent Backdoors

A sophisticated phishing campaign has been active since at least April 2025 and has impacted over 80 organizations (primarily in the U.S.) by deploying vendor-signed Remote Monitoring and Management tools to maintain stealthy, persistent access. Attackers install two independent RMMs (self-hosted SimpleHelp 5.0.1 and a ScreenConnect relay) to create redundant, self-healing remote access, persist through Safe Mode via registry hive modifications, continuously exfiltrate security posture data, and evade detection by renaming system binaries and leveraging legitimate signed software.