[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW6QMd5KttKKxdzOax9bgTzCgz34XMbSvkXXmXUBRcNA":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"bb3bf71e-d7fe-4b70-9526-ad66a5d48707","RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant","rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-9bce32","Huntress has published the Huntress Tragic Quadrant, a ranking of the cyber tactics its Security Operations Center (SOC) is detecting and shutting down most often, plotted against what the company calls “pucker factor”: how close each tactic puts an organisation to major damage once it lands. Built on telemetry from more than 5 million endpoints […] The post RMM abuse behind 45% of endpoint incidents as Huntress publishes inaugural Tragic Quadrant appeared first on IT Security Guru.","Huntress has released its inaugural Tragic Quadrant, a new report that ranks the most frequently detected cyber tactics against their potential for causing significant damage. The report, based on telemetry from over 5 million endpoints, highlights that Remote Monitoring and Management (RMM) tool abuse is behind 45% of all endpoint incidents observed by Huntress's Security Operations Center (SOC).","Huntress's Tragic Quadrant ranks cyber tactics by frequency and potential damage.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F10\u002F01\u002Frmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant\u002F?utm_source=rss&utm_medium=rss&utm_campaign=rmm-abuse-behind-45-of-endpoint-incidents-as-huntress-publishes-inaugural-tragic-quadrant",null,"2026-10-01T13:47:29+00:00","2026-10-01T14:00:18.177068+00:00",7,[17,20],{"name":18,"type":19},"Remote Monitoring and Management (RMM) tools","product",{"name":21,"type":22},"Huntress","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":12,"name":25,"slug":26},"Threat Intelligence","threat-intelligence",[28,33,38],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":34},{"id":35,"icon":12,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":23,"icon":12,"name":25,"slug":26},[],[21,18],{"controls":43,"vendors":123},[44,72,95],{"slug":45,"name":46,"problem":47,"products":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[49,56,64],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":45,"product_name":53,"url":54,"description":55},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":73,"name":74,"problem":75,"products":76},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[77,82,87],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":78,"product_name":79,"url":80,"description":81},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":83,"product_name":84,"url":85,"description":86},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,107,115],{"vendor_slug":101,"vendor_name":21,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[124],{"slug":101,"name":21,"logo_path":102,"roles":125},[126],"reported_by",{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":143},"rmm-tool-abuse-drives-nearly-half-of-all-endpoint-incidents","RMM Tool Abuse Drives Nearly Half of All Endpoint Incidents","Remote Monitoring and Management (RMM) tools are being systematically weaponized by attackers, accounting for 45% of endpoint incidents detected across over 5 million endpoints. Because RMM tools are designed to have deep, privileged access to systems, adversaries who abuse them can move laterally, execute commands, and maintain persistence with minimal detection. Attackers exploit these tools either by compromising legitimate RMM agents already installed or by deploying unauthorized RMM software as a backdoor — effectively hiding malicious activity behind trusted, allowlisted processes. This matters because defenders often overlook RMM traffic as routine administrative noise, giving attackers extended dwell time. Organizations must treat RMM tools with the same rigor as any high-privilege access vector.",[132,133,134,135,136,137,138,139,140,141,142],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-4: System Monitoring","MITRE ATT&CK T1219: Remote Access Software","ITIL: Service Configuration Management — Unauthorized Software Control",{"CIS Control 8: Audit Log Management":144,"NIST SP 800-53 AC-17: Remote Access":145,"NIST SP 800-53 SI-4: System Monitoring":146,"NIST SP 800-53 AC-2: Account Management":147,"CIS Control 6: Access Control Management":148,"NIST SP 800-53 CM-7: Least Functionality":149,"MITRE ATT&CK T1219: Remote Access Software":150,"NIST SP 800-53 AU-12: Audit Record Generation":151,"CIS Control 12: Network Infrastructure Management":152,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":153,"ITIL: Service Configuration Management — Unauthorized Software Control":154},"Logging RMM sessions and commands provides the evidence to detect abuse of these powerful tools.","Controlling and authorising remote access tools ensures attackers cannot use RMM software for hands-on access.","System monitoring can flag new RMM installs or sessions from unexpected sources.","Managing RMM accounts, including MFA and removing unused ones, stops attackers using stolen credentials to access them.","Access control limits who can use RMM tools and with what privileges, reducing their value to attackers.","Least functionality means removing unneeded RMM tools, closing a route attackers abused in 45% of incidents.","Describes attackers' use of legitimate remote access software like RMM tools, which detection should cover.","Generating audit records of RMM activity helps spot unusual command execution or lateral movement.","Network controls can block connections to unapproved RMM services used by attackers.","Secure configuration includes allowing only approved RMM tools, so unauthorised remote management software cannot be installed.","Configuration management tracks approved software, helping detect unauthorised RMM tools appearing on endpoints."]