Tales of Too Many RMMs

This Huntress report describes multiple real incidents in which threat actors exploited legacy RMM and unsecured remote access (including RDP without MFA) to install additional RMM tools, exfiltrate credentials, and deploy ransomware (notably Akira), highlighting the complexity of detecting abuse when multiple remote access tools are present and stressing the need for accurate asset inventories, attack-surface reduction, and full EDR coverage.