Cato CTRL™ Threat Research: Investigation of RMM Tools Leveraged by Ransomware Gangs in Real-World Incidents 

This report examines multiple 2024–2025 incidents where ransomware gangs leveraged legitimate Remote Monitoring and Management (RMM) tools—including AnyDesk, ScreenConnect, PDQ Deploy, and SimpleHelp—to gain initial access, maintain persistence, move laterally, and exfiltrate data. It summarizes three real-world cases (UK and US victims), describes an RMM PoC via phishing, shows network detection examples (Wireshark/Cato XDR), and provides operational recommendations (allowlisting, privilege limitation, monitoring, and auditing) to detect and mitigate RMM-based abuse.