Rogue RMM Abuse: How Attackers Exploit Remote Access Tools

Attackers are abusing trusted remote-monitoring-and-management (RMM) tooling by using phishing lures (malicious ZIP/PDFs or hosted document-share pages) to install rogue ITarian and ScreenConnect clients with SYSTEM persistence; they often chain multiple RMM installations for redundant access and use defense-evasion binaries, making detection difficult. Huntress SOC observed multiple incidents and a notable spike in RMM abuse, and advises organizations to inventory approved RMMs and detect unauthorized clients to fully remediate persistent access.