Security Guidance on RMM Abuse and Hardening Against Destructive Attacks
Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Mar 7, 2026
Security reporting and guidance highlighted how legitimate Remote Monitoring and Management (RMM) tools are increasingly being weaponized for intrusion and rapid ransomware deployment. Huntress data cited a 277% increase in RMM abuse in 2025, with attackers leveraging trusted, often pre-installed binaries to obtain hands-on-keyboard access that blends into normal IT activity; the reporting also noted that over half of suspicious Atera activity observed in cases reviewed was associated with ransomware, and that abuse of tools such as RustDesk or Atera can enable ransomware impact within 1–2 hours once access is established.
Separately, Google/Mandiant published defensive hardening recommendations focused on reducing the blast radius of destructive attacks (including ransomware) by protecting virtualization management planes (e.g., VMware vSphere/vCenter/ESXi and Microsoft Hyper-V). The guidance emphasizes defense-in-depth and Zero Trust network design—particularly isolating management interfaces into dedicated VLANs/segments and limiting administrative access paths—because management appliances may lack native MFA for local privileged accounts, making credential compromise a high-risk failure mode.
