<span id="hs_cos_wrapper_post_body" class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_rich_text" style="" data-hs-cos-general-type="meta_field" data-hs-cos-type="rich_text" ><p>Remote Monitoring and Management (RMM) tools are a vital part of modern IT operations. They help organizations increase efficiency, reduce costs, and manage endpoints remotely. Unfortunately, threat actors have also recognized their value. Over the past year, attackers have increasingly abused both legitimate and rogue RMM tools to gain access, maintain persistence, and execute malicious actions in victim environments.</p> <!--more--><p>Recent incidents observed by Huntress highlight a concerning trend: multi-stage attack chains that involve the use of multiple RMM tools, including <span style="font-weight: normal;">ScreenConnect</span>, GoTo Resolve, SimpleHelp, TeamViewer, and more. These campaigns often start with phishing or social engineering, then pivot to deploying secondary (or even tertiary) RMMs to ensure that threat actors retain access even if the first tool is removed.</p> <p>ThreatSTOP’s proactive protections are specifically designed to prevent this type of activity before attackers can establish a foothold in your environment. Our customers frequently report attempts at “shadow IT” access, and AnyDesk consistently ranks as the most common target.</p> <h3><strong>The Growing Threat of Rogue RMMs</strong></h3> <p><a href="https://www.huntress.com/blog/series-of-unfortunate-rmm-events" rel="noopener" target="_blank">Huntress research</a> shows that threat actors are increasingly chaining RMMs for layered persistence. A common attack sequence involves:</p> <ol> <li><span style="font-weight: normal;">Phishing lure leading to the initial RMM installation (e.g., GoTo Resolve).</span></li> <li><span style="font-weight: normal;">Secondary RMM deployment (e.g., ScreenConnect or SimpleHelp) for redundant access.</span></li> <li><span style="font-weight: normal;">Persistence mechanisms such as scheduled tasks or “living off the land” techniques.</span></li> <li><span style="font-weight: normal;">Command-and-control communications to attacker-controlled infrastructure for long-term compromise.</span></li> </ol> <p style="font-weight: normal;">Some notable patterns include:</p> <ul> <li><span style="font-weight: normal;">GoTo Resolve → ScreenConnect: Attackers first install a disguised GoTo Resolve client, then use it to deploy ScreenConnect for secondary access. &nbsp;</span></li> <li><span style="font-weight: normal;">PDQ → SimpleHelp: Threat actors leverage PDQ to push malicious SimpleHelp instances. &nbsp;</span></li> <li><span style="font-weight: normal;">Chained RMM Installations: In some cases, attacks involve three layers of RMMs, ensuring that even if one is removed, others remain active. &nbsp;</span></li> </ul> <p>These attacks are dangerous because rogue RMMs can appear legitimate, making it difficult for traditional monitoring to distinguish between authorized and malicious activity.</p> <h3><strong>How ThreatSTOP Blocks Rogue ScreenConnect and RMM Abuse</strong></h3> <p>ThreatSTOP provides <span style="font-weight: normal;">Protective DNS and IP-based protections</span> that can prevent rogue RMM activity before it impacts your network:</p> <ul> <li>DNS Defense Cloud and DNS Defense block malicious domains used by ScreenConnect and SimpleHelp instances for command-and-control, as well as in this case, the phishing domains themselves. &nbsp;ThreatSTOP neutralizes this entire chain of attacks.</li> <li>IP Defense stops outbound connections to attacker-controlled IP addresses, cutting off data exfiltration and remote access attempts. &nbsp;</li> </ul> <p><span style="font-weight: normal;">Our Security, Intelligence, and Research team con</span>tinuously monitors for threats like:</p> <ul> <li>Command-and-control infrastructure for rogue RMMs <span>&nbsp;</span></li> <li>Malicious executables and phishing lures delivering RMM installers <span>&nbsp;</span></li> <li>Abuse of RMM free trial domains or recently registered domains used in attacks</li> <li><span>We also have software that monitors the rate of change in RMM software on a customer network. &nbsp;If there is a sudden increase in the amount, sometimes this indicate a rogue installation.&nbsp;</span></li> </ul> <p>By applying ThreatSTOP’s proactive protections across your DNS and network infrastructure, you can prevent these threats even if an endpoint is tricked into running a rogue installer.</p> <h3><strong>Take Control of Your RMM Security Today</strong></h3> <p>Proactive protection is critical in an age where attackers exploit the very tools you trust. ThreatSTOP provides comprehensive coverage for ScreenConnect and other abused RMM platforms, reducing your risk of compromise and persistence-based attacks. &nbsp;<span style="font-weight: bold;">Allow the RMMs you authorize on your network, and block the rest.</span></p> <p style="font-weight: normal;">For those interested in joining the ThreatSTOP family, or to learn more about our proactive protections for all environments, we invite you to <a href="/threatstop-platform" rel="noopener" target="_blank">visit our product page</a>. Discover how our solutions can make a significant difference in your digital security landscape. We have pricing for all sizes of customers! Get started with <a href="https://admin.threatstop.com/register?hsLang=en" rel="noopener" target="_blank">a Demo today</a>!</p> <p><strong>Connect with Customers, Disconnect from Risks</strong></p> <p><strong>MITRE ATT&amp;CK Mapping for Rogue RMM Coverage</strong></p> <table style="border-collapse: collapse; table-layout: fixed; margin-left: auto; margin-right: auto; border: 1px solid #99acc2;" data-hsprotectcellspacing="0"> <tbody> <tr> <td style="padding: 0px;" data-hsprotectvalign="top"> <p><strong>Tactic</strong></p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p><strong>Technique</strong></p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p><strong>ThreatSTOP Mitigation</strong></p> </td> </tr> <tr> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Initial Access</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>T1566.001: Phishing Attachment</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Blocks malicious domains via DNS/IP Defense</p> </td> </tr> <tr> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Execution</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>T1204.002: User Execution of Malicious File</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Disrupts download of rogue RMM installers</p> </td> </tr> <tr> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Persistence</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>T1053: Scheduled Task Creation</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Stops C2 communications for persistence</p> </td> </tr> <tr> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Command and Control</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>T1071.004: Application Layer Protocol (Web)</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Blocks ScreenConnect and SimpleHelp C2 traffic</p> </td> </tr> <tr> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Exfiltration &amp; Lateral Move</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>T1041: Exfiltration Over C2 Channel</p> </td> <td style="padding: 0px;" data-hsprotectvalign="top"> <p>Cuts off outbound traffic to attacker servers</p> </td> </tr> </tbody> </table></span>