Full Report
Over the past year, the Huntress team has posted a number of blog posts related to remote monitoring and management (RMM) tools being installed or abused by threat actors.
Analysis Summary
# Tool/Technique: Malicious Use of Remote Monitoring and Management (RMM) Tools
## Overview
RMM tools are legitimate software packages used by IT professionals and Managed Service Providers (MSPs) for remote administration. Threat actors abuse these tools to maintain persistent access, bypass security controls (as the software is often allow-listed), and execute malicious payloads. The focus here is on the exploitation of both "rogue" installations (newly installed by the attacker) and "legacy" installations (pre-existing, often forgotten instances).
## Technical Details
- **Type**: Tool / Technique (Living-off-the-land via third-party software)
- **Platform**: Windows, macOS, Linux
- **Capabilities**: Remote desktop access, file transfer, command execution, persistence, data exfiltration.
- **First Seen**: Ongoing; significant increase in SMB/MSP-focused attacks observed throughout 2023–2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services]
- [T1566 - Phishing] (Used to deliver RMM installers like Tiflux)
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]
- **[TA0005 - Defense Evasion]**
- [T1219 - Remote Access Software]
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service]
## Functionality
### Core Capabilities
- **Unattended Access**: Establishing permanent remote gateways into a network without requiring user interaction.
- **File Deployment**: Uploading ransomware (e.g., LockBit variants), batch files, or miners.
- **Credential Abuse**: Leveraging stolen credentials from infostealers or Initial Access Brokers (IABs) to log into existing RMM accounts (e.g., TeamViewer).
### Advanced Features
- **Tool-Chain Deployment**: Using one RMM or deployment tool (like PDQ or GoTo Resolve) to push additional, secondary RMM tools for redundancy.
- **LOLBins Integration**: Using native utilities like `curl.exe` through the RMM console to exfiltrate data to actor-controlled infrastructure.
## Indicators of Compromise
- **File Names**:
- `pp.bat` (Malicious batch script)
- `LB3_rundll32_pass.dll` (LockBit ransomware variant)
- `connections_incoming.txt` (TeamViewer log file showing suspicious IP addresses)
- **Network Indicators**:
- Connections to `*.screenconnect[.]com` (Unauthorized instances)
- Connections to `*.rustdesk[.]com`
- Connections to `*.anydesk[.]com`
- **Behavioral Indicators**:
- `curl.exe` spawning from RMM agent processes for outbound data transfer.
- RMM installation originating from `msdl.exe` (MSSQL) or other atypical parent processes.
- High-frequency connections from unauthorized geographic regions in RMM logs.
## Associated Threat Actors
- **LockBit Affiliates**: Observed deploying ransomware via TeamViewer.
- **Cryptojacking Groups**: Observed deploying XMRig via TeamViewer.
- **Initial Access Brokers (IABs)**: Storing and selling RMM credentials.
- **Support Scammers**: Frequently use ScreenConnect and AnyDesk.
## Detection Methods
- **Signature-based**: Detection of known ransomware DLLs (e.g., LockBit) or cryptocurrency miners (XMRig) being dropped in RMM temp folders.
- **Behavioral detection**:
- Monitoring for RMM tools that do not match the organization’s standard software stack.
- Alerting on RMM services running on servers (e.g., MSSQL) that should not have remote desktop access.
- **Log Analysis**: Auditing TeamViewer `connections_incoming.txt` or ScreenConnect session logs for unfamiliar source machine names or prolonged sessions at odd hours.
## Mitigation Strategies
- **Uninstall Legacy Software**: Remove all instances of RMM tools (TeamViewer, AnyDesk) that are not actively used or managed by the organization.
- **Identity Security**: Enforce Multi-Factor Authentication (MFA) on all RMM accounts to prevent credential stuffing or infostealer-based attacks.
- **Software Restriction Policies**: Use Application Control (AppLocker/WDAC) to block unauthorized RMM binaries from executing.
- **Network Segmentation**: Restrict RMM traffic to known, authorized administrative IP ranges.
## Related Tools/Techniques
- **ScreenConnect / ConnectWise Control**
- **AnyDesk**
- **RustDesk**
- **TeamViewer**
- **Tiflux**
- **GoTo Resolve / PDQ**