[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbGCgd1rXcD8sZGZwwZd1ZuecUCmmBRSlYQkkW_1vCQ0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"84f7bc04-a815-4679-a3ec-25db94ff3aa9","phishing-campaigns-weaponize-legitimate-rmm-tools-for-stealthy-remote-access","ff5efb8b-999f-4f58-8d09-5296650c39b2","Phishing Campaigns Weaponize Legitimate RMM Tools for Stealthy Remote Access","Attackers are exploiting the trusted reputation of legitimate RMM tools like MSP360 and Faronics Deploy Agent by disguising malicious installers as routine meeting invitations or software updates, bypassing user suspicion. Once installed, these tools grant full remote management access, which is then used to layer a second RMM tool (ScreenConnect) as a redundant backdoor — making detection and eviction significantly harder. This 'dual-RMM' technique is particularly dangerous because security controls that whitelist legitimate remote management software may not flag the activity as malicious. The root issue is a lack of user awareness combined with insufficient controls over what software can be installed and which remote access tools are authorized in the environment.","**Immediate actions:**\n- Audit all currently installed RMM tools across endpoints and immediately remove any that are unauthorized or unrecognized.\n- Block execution of RMM installers received via email or downloaded from unverified sources using application control policies.\n\n**Long-term improvements:**\n- Establish and enforce an approved RMM tool allowlist, ensuring only sanctioned tools with known endpoints can establish remote sessions.\n- Conduct regular security awareness training focused on recognizing phishing lures disguised as meeting invitations or software update prompts.\n- Implement a formal software installation approval process that requires IT authorization before any remote management agent can be deployed.\n\n**Detection measures:**\n- Deploy behavioral monitoring rules to alert on unexpected RMM tool installations or outbound connections to known RMM infrastructure (e.g., ScreenConnect relay servers).\n- Monitor for the sequential installation of multiple RMM tools within a short time window as a high-fidelity indicator of compromise.\n- Centralize and review endpoint telemetry logs to detect unusual remote session initiations, especially outside of business hours.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 CM-7: Least Functionality","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566: Phishing",{},"published","2026-09-30T18:20:46.643396+00:00","2026-09-30T18:20:46.497+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-abuse-msp360-to-deploy.html","attackers-abuse-msp360-to-deploy-screenconnect-in-dual-rmm-phishing-attacks-cb2af8","Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]