RMM abuse

Named by 5 kept items in this workspace.

4 items name it under techniques and 1 under classification.key entities.

Search every workspace for RMM abuse. It matches the name as written, so it can find other things that share it.

The items that name it 5

Managed for Malice: How Attackers Turn MDM into Remote Access
writeupas classification.key entities2026-10-28
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
articleas techniques2026-10-01
Attacker installs or hijacks a Remote Monitoring and Management tool to gain persistent access that blends in with routine admin work; 45% of endpoint-related incidents in Q1 2026; AI-accelerated via fake document shares and service agreement lures
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
writeupas techniques2026-09-03
Deployment of rogue ScreenConnect and UltraViewer instances as top attack vector for gaining and maintaining remote access.
LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
articleas techniques2026-07-08
Abuse of remote monitoring and management tools; cited as jumping 277% in 2025, supporting ransomware and BEC objectives
Threats Plague Educational Organizations
writeupas techniques2025-11-13

All techniques in this workspace.