Insights: RMM Tools | Huntress Blog

Huntress warns that threat actors are leveraging legitimately installed remote-access/RMM tools (especially TeamViewer) via compromised credentials to maintain persistence in SMB environments. Incidents observed include attempted ransomware deployment and XMRig miner installation, often limited to the accessed endpoints without extensive lateral movement; Huntress advises accurate asset/application inventories and reviewing TeamViewer 'connections_incoming.txt' logs to detect unauthorized access.