Full Report
RMM abuse jumped 277% & now shows up nearly 40% of Huntress investigations. See how attackers exploit trusted remote access tools, and how to stop it.
Analysis Summary
# Tool/Technique: RMM Abuse (Living off the Land)
## Overview
RMM (Remote Monitoring and Management) abuse is a technique where threat actors utilize legitimate, commercially available remote access software to gain unauthorized access, maintain persistence, and execute commands within a target environment. By using trusted, digitally signed tools, attackers "blend into the noise," making their activities appear identical to routine IT administration and bypassing traditional signature-based security layers.
## Technical Details
- **Type**: Technique (Living off the Land) / Dual-use Tool Abuse
- **Platform**: Windows, macOS, Linux (Cross-platform support common in RMMs)
- **Capabilities**: Remote desktop access, file transfer, command execution (PowerShell/CMD), system monitoring, and administrative persistence.
- **First Seen**: Ongoing; report highlights a **277% increase** in abuse over the last year.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]: Convincing users to download "meeting apps" or "support tools" that are actually RMM installers.
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]: Installing rogue RMMs to ensure long-term access.
- **[TA0005 - Defense Evasion]**
- [T1218 - System Binary Proxy Execution]: Using trusted RMM binaries to execute malicious commands.
- [T1562.001 - Impair Defenses: Disable or Modify Tools]: Using RMM access to disable security software.
- **[TA0008 - Lateral Movement]**
- [T1210 - Exploitation of Remote Services]: Moving between internal systems using the RMM's native deployment features.
## Functionality
### Core Capabilities
- **Remote Control:** Full GUI access to the victim's desktop.
- **Command Shell:** Direct access to terminal interfaces (PowerShell/CMD) to run scripts.
- **File Manipulation:** Uploading malicious payloads and exfiltrating data via built-in file transfer protocols.
- **Trusted Communication:** Traffic often uses standard ports (443) and communicates with known vendor domains, bypassing firewall restrictions.
### Advanced Features
- **Persistence (Dormancy):** Attackers can install a "sleeper" RMM that remains inactive for months (e.g., a ScreenConnect instance documented sitting idle for five months) to avoid detection during the initial compromise phase.
- **Identity Hijacking:** Accessing local browser cookies and saved credentials to set up malicious inbox rules or send spam from the victim's legitimate account.
## Indicators of Compromise
- **File Names:**
- `ScreenConnect.Client.exe`
- `AnyDesk.exe`
- `ConnectWiseControl.Client.exe`
- *Note: Attackers may rename these to appear as "Meeting_App.exe" or "Recruitment_Info.exe".*
- **Network Indicators:**
- `*.screenconnect[.]com`
- `*.anydesk[.]com`
- `*.relay.screenconnect[.]com`
- **Behavioral Indicators:**
- Presence of multiple different RMM brands on a single endpoint.
- RMM installation initiated by a user in a department that does not require it (e.g., Finance, HR).
- Creation of unauthorized inbox rules (Forwarding/Deleting) immediately following RMM activity.
- RMM processes executing PowerShell scripts with encoded commands.
## Associated Threat Actors
- **Access Brokers:** Groups that sell initial access to ransomware affiliates.
- **Ransomware Groups:** General usage to deploy final payloads.
- **Social Engineers:** Attackers posing as recruiters (e.g., "Pepsi recruiter" lure) or IT support.
- **Faronics Deploy Abusers:** Specifically linked to phishing campaigns deploying ScreenConnect.
## Detection Methods
- **Inventory Baseline:** Maintaining a "Known Good" list of authorized RMM tools and flagging any unauthorized variants (e.g., if the company uses AnyDesk, flag ScreenConnect).
- **Behavioral Detection:** Monitoring for "unusual administration" such as RMM activity outside of business hours or activity originating from unexpected geographic locations.
- **Identity Monitoring:** Detecting anomalies in O365/Google Workspace (new inbox rules, bulk spam) occurring concurrently with RMM process execution.
## Mitigation Strategies
- **Application Control:** Implementing policies (like Huntress RMM Guard) to prevent the execution of unauthorized remote access binaries.
- **Principle of Least Privilege:** Restricting the ability of standard users to install new software or services.
- **Network Segmentation:** Restricting RMM traffic to specific administrative segments of the network.
- **User Education:** Training employees to verify IT requests through secondary channels before downloading remote support software.
## Related Tools/Techniques
- **AnyDesk**
- **ScreenConnect (ConnectWise)**
- **Atera**
- **TeamViewer**
- **Faronics Deploy**
- **Living off the Land (LotL)**