Loading story…
Huntress investigated three phishing-led intrusions in which attackers abused legitimate remote monitoring and management (RMM) tools to gain persistent access. One campaign used a TransferXL-hosted ZIP archive and malicious PDF lure to prompt installation of ITarian, then deployed ScreenConnect; two others used fraudulent document-sharing emails branded as ScreenConnect to install multiple ScreenConnect clients.
The attackers configured rogue RMM agents for SYSTEM-level persistence, created redundant remote-access channels, and used defense-evasion tooling including HideUL_x64.exe. Huntress reported RMM abuse rose 277% during 2025 and appeared in nearly 40% of incidents investigated by its Tactical Response team, underscoring the need to restrict, inventory, and monitor authorized remote-management software.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Huntress tracked a 277% increase in abuse of remote monitoring and management tools during 2025. Its Tactical Response team observed RMM abuse in nearly 40% of the incidents it investigated.
In a separate incident, an attacker used a ScreenConnect client that had remained undetected for five months to access a user's browser and create malicious email inbox rules.
In two related incidents, emails claiming to share documents through ScreenConnect redirected victims from an Adobe InDesign lure page to attacker-controlled infrastructure that installed rogue ScreenConnect clients. The actors used HideUL_x64.exe for defense evasion and added a second rogue ScreenConnect installation on each affected system before Huntress intervened.
A phishing lure posing as a TransferXL secure document led a victim through a ZIP archive and malicious PDF to install an attacker-controlled ITarian client. The attacker then deployed ScreenConnect, configuring both RMM clients for SYSTEM-level persistent access.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign active since January 2026 has targeted victims in 46 countries—45% of observed activity involved the United States—using tax forms, Social Security notices, invoices, VAT, shipping, Adobe PDF, and shared-file lures. Victims are sent to short-lived pages hosted on services including Vercel, Netlify, Amazon S3, and DigitalOcean Spaces, or on compromised sites, then prompted to download password-protected ZIP archives. The archives use a VBS-to-PowerShell chain to retrieve signed installers for legitimate remote monitoring and management (RMM) products, giving operators interactive access without relying on conventional malware. The operators rotate among GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, limiting the value of product-specific blocking. Researchers identified 425 delivery-kit URLs across 240 hosts between February 5 and July 29, with 94% of hosts remaining live for only one day; stable kit artifacts included `fmtt` font files, `font1.woff2`, `icons8-microsoft-word-94.png`, and a `secure.html`-to-ZIP delivery chain. Organizations should detect and investigate unauthorized RMM deployments, particularly script-initiated PowerShell downloads of MSI installers, newly installed support software, and password-protected ZIP files delivered through phishing pages.
Aug 26, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Threat reporting has highlighted phishing-led intrusions in which attackers use legitimate remote monitoring and management (RMM) software to gain and retain access to victim environments. The approach can obscure malicious activity within approved administrative tooling, creating a material visibility gap for security teams and enabling adversaries to operate without deploying obviously malicious remote-access malware. The activity includes a U.S.-targeted phishing campaign and broader organized-cybercrime tradecraft that pair social engineering with RMM abuse. Organizations should treat unexpected RMM installation, new unattended-access configurations, and remote-control sessions initiated after phishing activity as high-priority signals; enforce application allowlisting and least privilege for RMM tools; and require strong authentication, centralized logging, and alerting for all remote-management access.
Sep 9, 2026