RMM Abuse: When IT Convenience Bites Back

What it is

Huntress's breakdown of RMM (Remote Monitoring and Management) abuse as an attack technique, tied to the 2026 Cyber Threat Report's 277% year-over-year increase in 2025. The core argument is a defender-side one the summary doesn't carry: approved-tool trust is the vulnerability, and detection has to move from "is this software present/approved" to "is this specific session behaving normally."

How it works

Attackers favor pre-installed, legitimate RMM binaries over custom malware because valid RMM binaries carry no bad signature and slip past EDR "in the name of business continuity." Once an RMM is compromised (via rogue-agent phishing or stolen credentials), the attacker inherits its designed persistence — interactive hands-on-keyboard access to automate tasks, move laterally, run commands, and drop ransomware while looking like an IT admin. The MSP angle is the multiplier: compromising an RMM used by a managed service provider yields direct interactive access to every customer that MSP manages, which is why the SOC case (stolen IT-technician credentials) could have reached all MSP-managed environments.

Preconditions / Affected

Matters for any org running approved RMM tooling, and acutely for MSPs and their downstream customers. The trust assumption that makes it exploitable: an admin seeing expected RMM traffic (e.g., a remote employee reaching their laptop) marks it "normal" without checking the session's timing, user, or behavior.

What to do

The page's actionable guidance:

• Verify behavior, not presence. Don't treat every instance of an approved tool as trusted. Flag strange timing, unexpected users, or unusual behavior for a second look even when the tool itself is authorized.
• Define a normal-activity baseline and watch for anomalies against it.
• Keep up tool fingerprinting to spot unauthorized or unusual remote-access activity quickly.
• Treat people as a detection layer — security awareness training, mindful IT reviews, and a "see something, say something" culture to catch suspicious behavior before ransomware/exfiltration.

The 2025 phishing lure themes to train users against (a rogue RMM install often hides behind these), by share:

• E-signature request — 14.2%
• Invoice notification — 7.8%
• Voicemail notification — 7.5%
• File share — 6.8%

Caveats

This is a vendor blog; the mitigations are directional (baseline, fingerprint, train) rather than specific detections, rules, or product configuration. The fetched text cuts off at the start of the "Define the baseline" section, so any concrete baselining steps beyond the summary above are not captured here.