Full Report
The abuse of remote monitoring and management (RMM) tools is surging. See how threat actors daisy chain RMM software for initial access, persistence, and detection evasion.
Analysis Summary
# Tool/Technique: Daisy-Chaining Rogue RMM Tools
## Overview
This technique involves the sequential deployment of multiple Remote Monitoring and Management (RMM) tools to establish initial access, maintain persistence, and evade detection. By "daisy-chaining" these legitimate, signed applications, threat actors fragment their telemetry across different platforms, making attribution and containment significantly more difficult for security teams.
## Technical Details
- **Type**: Technique / Living-off-the-Land (LotL)
- **Platform**: Windows
- **Capabilities**: Remote desktop access, file transfer, command execution, credential harvesting, and persistence.
- **First Seen**: Increased surge noted in late 2025; specific campaign analysis conducted December 2025 – January 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing] (Abusing deployment links or MSI installers)
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]
- **[TA0005 - Defense Evasion]**
- [T1218.005 - System Binary Proxy Execution: Msiexec]
- [T1027 - Obfuscated Files or Information] (LLM-generated scripts)
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery] (Parsing browser history for financial sites)
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software]
## Functionality
### Core Capabilities
- **Legitimate Execution**: Uses validly signed installers (MSI) for tools like ScreenConnect or Action1 to bypass basic execution prevention.
- **Remote Orchestration**: Provides full GUI or CLI access to the victim's machine without triggering traditional malware alerts.
- **Telemetry Fragmentation**: By moving from one RMM tool to a second one (e.g., using Action1 to deploy ScreenConnect), the actor splits the audit trail.
### Advanced Features
- **LLM-Augmented Scripting**: Use of Large Language Models to generate infostealers and deployment scripts (WScript) that parse browser history for QuickBooks, Coinbase, and other financial targets.
- **Automated Notifications**: Integration with Telegram APIs (seen in "InjectProx-hiro") to alert attackers immediately upon successful installation.
## Indicators of Compromise
- **File Names**:
- Rogue MSI installers for ScreenConnect, Action1, or SimpleHelp.
- `InjectProx-hiro` related scripts.
- **Network Indicators**:
- `api[.]telegram[.]org` (Exfiltration/Notification)
- `*.screenconnect[.]com` (Unauthorized instances)
- `*.action1[.]com`
- **Behavioral Indicators**:
- `msiexec.exe` spawning from unexpected parent processes or downloading RMM packages from non-corporate domains.
- `wscript.exe` or `cscript.exe` executing scripts that perform browser history parsing.
- Unexpected presence of multiple RMM agents on a single endpoint.
## Associated Threat Actors
- **Low-skilled "Script Kiddies"**: Leveraging LLM-generated code.
- **Financially Motivated Actors**: Targeting cryptocurrency and accounting software.
- **Established Groups**: Using RMM as a primary C2 framework to replace traditional backdoors.
## Detection Methods
- **Behavioral Detection**: Monitor for "RMM-on-RMM" activity (e.g., one RMM agent being used to download and install a different RMM tool).
- **Process Monitoring**: Alert on `wscript.exe` or `powershell.exe` making external connections to Telegram or RMM provider domains.
- **Audit Logs**: Review RMM console logs for unauthorized new account creations or suspicious deployment tasks.
## Mitigation Strategies
- **Application Whitelisting**: Restrict RMM tool execution to only the specific vendor authorized by the organization.
- **Network Filtering**: Block access to known RMM URLs and Telegram APIs if not required for business operations.
- **Egress Filtering**: Restrict common RMM ports and monitor for high-volume data transfers to remote support domains.
- **Hardening**: Disable WScript and CScript if not required for administrative tasks.
## Related Tools/Techniques
- **ScreenConnect (ConnectWise Control)**
- **Action1**
- **SimpleHelp**
- **Faronics Deploy**
- **AnyDesk / TeamViewer** (Commonly used in similar daisy-chaining scenarios)