🎯 RMM tool abuse for persistence and C2

The items that name it 2

• The Fine Art of Frustrating the Adversary
  article2026-10-01

  Adversaries (e.g., ransomware operators) use legitimate remote monitoring and management tools to establish persistence and interact with compromised systems before encryption.

• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeup2026-09-15

  NetSupport Manager reconfigured to redirect data to hostile infrastructure, disable alerts, and establish persistence via keyboard filter driver, Windows service, Winlogon, Run key, and scheduled task