A Series of Unfortunate (RMM) Events

Huntress SOC observed a series of active campaigns in which attackers use phishing lures to deliver and then chain multiple remote monitoring and management (RMM) tools—both legitimate and renamed/rogue instances—to establish persistence and operational access (examples include GoTo Resolve, PDQ, ScreenConnect, SimpleHelp, and ITarian). The report documents several case studies, execution paths, attacker-controlled domains and download sources as IoCs, and recommends defenses such as asset inventory, RMM auditing, application controls, and log monitoring.