Hackers Exploit Remote Management Tools to Gain Initial Access to Corporate Networks

Threat actors are increasingly abusing legitimate Remote Monitoring and Management (RMM) tools to infiltrate corporate networks and establish long‑term access.

Security researchers warn that attackers are using these trusted administrative tools to blend malicious operations with routine IT management activity, allowing them to bypass many traditional security defenses.

Surge in RMM Tool Abuse

Security researchers from Huntress recently found that threat intelligence shows a dramatic rise in attacks involving RMM software.

Security analysts report that abuse of remote management tools increased by approximately 277% over the past year, accounting for nearly a quarter of observed cybersecurity incidents.

Instead of deploying conventional malware, attackers are building their entire operational playbooks around trusted system administration utilities.

By using legitimate software commonly found in enterprise environments, adversaries can evade endpoint detection systems that typically flag unknown executables or suspicious binaries.

A growing technique involves “daisy‑chaining” multiple remote access tools during an intrusion. In these attacks, one administrative platform is used to deploy another remote control tool, fragmenting security telemetry and complicating detection.

For example, threat actors have been observed abusing vulnerability management software such as Action1 to silently install secondary remote access clients like ScreenConnect using Microsoft Installer (MSI) packages.

Because these deployment packages are legitimately signed, they appear authentic and can easily bypass many security controls.

Researchers also note that lower-skilled attackers are increasingly relying on Large Language Models (LLMs) to generate scripts used during these campaigns.

These scripts automate tasks such as credential harvesting and browser data collection, including attempts to parse browsing histories for cryptocurrency wallets or financial platform logins.

However, many of these AI-generated scripts still show technical limitations. In several observed cases, the scripts failed to properly implement data exfiltration mechanisms, leaving harvested information stored locally on compromised systems instead of being transmitted back to attackers.

Social engineering remains the primary delivery method for these remote access tools. Attackers distribute malicious installers through carefully crafted phishing campaigns designed to trick victims into executing legitimate-looking software.

Common lures include:

• Impersonation of government agencies such as the Social Security Administration during tax season.
• Fake meeting invitations or event RSVPs containing malicious installer files.
• Mobile-focused phishing pages offering fake online greeting cards designed to harvest credentials.

Defending Against Rogue RMM Deployments

Security experts warn organizations to treat any unauthorized remote management installation as a critical security event.

Because these tools are legitimate software, traditional signature-based defenses may fail to detect them.

Recommended defensive measures include:

• Implement strict allow-listing policies for approved administrative software.
• Monitor and investigate software installations originating from user-writable directories.
• Focus on behavioral detection, such as suspicious parent-child process relationships.
• Audit trial-based usage of administrative tools and demand stronger telemetry from vendors.

By improving visibility into remote management software usage and monitoring behavioral anomalies, organizations can significantly reduce the risk posed by this rapidly growing initial access technique.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.