Your Screen Is Being Monitored: Initial Access via RMM Tools

ReliaQuest reports that cybercriminals are increasingly abusing legitimate RMM tools (e.g., Atera, Splashtop, AnyDesk, ConnectWise/ScreenConnect, TeamViewer, ngrok, Netsupport) to bypass defenses, maintain persistent remote access, and enable ransomware/data exfiltration. The report provides observed host and network artifacts (process/service names and domains), cites actor usage (including Qbot, Scattered Spider, Black Basta, Conti), and recommends blocking unauthorized RMM network domains, implementing application allowlisting (GPO/SRP), and deploying detection/hunting rules to identify misuse.