How Threat Actors Abuse Remote Management Tools | Huntress

What it is

Huntress research on RMM abuse cases from December 2025–January 2026, expanding on the daisy-chaining pattern with specific tools, metrics, and indicators. RMM abuse was Huntress's most-observed threat last year at 24% of all incidents, and surged 277% year-over-year. The reported actors are mostly low-skill operators chasing initial access, not sophisticated groups.

How it works

Several distinct chains observed:

• Action1 → ScreenConnect: threat actors abuse Action1 (legitimate, signed vulnerability-management/deployment tooling) to push ScreenConnect clients via MSI packages for persistent access.
• wscript → ScreenConnect: the same daisy-chain reused with wscript installing additional payloads. Tooling branded "InjectProx-hiro Remote Support" deploys a ScreenConnect client and fires a Telegram bot notification containing the victim's computer name.
• Rogue RMM MSI → LLM-generated infostealer: MSI installers spawn infostealer scripts (assembled by LLMs, per coding style/comments) that parse browser history for financial/crypto references — QuickBooks, Coinbase — to identify monetizable access.
• HeartbeatRM: a lesser-known RMM delivered via invitation-themed lures.

Delivery is via broad phishing email and search-engine poisoning / watering-hole sites, funneling to invitation- or document-themed downloads. Lures impersonate the Social Security Administration and spike around US tax season.

Preconditions / Affected

Any environment where deployment/management software can run unmonitored. Huntress notes that any RMM or deployment tool offering trial or "free" deployment allowances is being abused or likely will be — the abused binaries are legitimately signed, so signature-based trust is the weak point.

What to do

The page names concrete indicators to hunt and report:

• Detections: alert on unexpected RMM installs, especially one RMM (or Action1/wscript) deploying a second RMM like ScreenConnect via MSI. Watch for browser-history parsing and Telegram API callbacks post-install.
• IOCs: GitHub accounts VH851 and Drasticc hosting phishing infrastructure (activity dating to Nov–Dec 2025); MSI lure invitatapartyTo.msi; a repo rty using a custom domain via GitHub CNAME to control phishing-site presentation.
• Huntress proactively reported the GitHub accounts.

Caveats

• The blog gives no full IOC list or hashes in the fetched text — only the named accounts/files above.
• Attacker maturity is low: one observed LLM-generated infostealer collected data locally but never implemented the Telegram exfiltration its own comments described, so exfil failed. Treat these operators as opportunistic and buggy, not precise.