RMM abuse isn’t a new concept, but the scale has changed dramatically. According to the Huntress 2026 Cyber Threat Report, abuse of RMM tools jumped 277% year-over-year. At the same time, traditional malware use dropped by 53%. That’s not a coincidence.
Attackers have figured out something important: it’s a lot easier to hide inside a trusted tool than it is to sneak in a piece of custom malware. Tools like ConnectWise ScreenConnect, Atera, AnyDesk, and NetSupport are well-known in business environments. Security solutions are often configured to trust them. Employees don’t question them. That’s exactly what makes them so dangerous in the wrong hands.
This is what security researchers call a “living-off-the-land” strategy. Instead of bringing their own weapons, attackers borrow yours.
There is no single playbook here. Attackers are deploying RMM tools through several different methods, and they’re evolving fast.
Phishing is still a primary entry point. Microsoft documented campaigns in February 2026 where attackers used fake workplace meeting lures, complete with stolen digital certificates, to trick employees into downloading what looked like legitimate software. Once clicked, the installer quietly deployed ScreenConnect, Tactical RMM, and MeshAgent in a layered chain, giving attackers multiple ways to maintain access even if one channel got detected.
Drive-by downloads are also in play. And just yesterday, researchers flagged an active SEO poisoning campaign targeting users searching for a legitimate data recovery tool called TestDisk. The fake site ranked high in search results, served a malicious installer, and silently deployed RMM software in the background. The victim thought they were downloading a utility. They were handing over remote access to their machine.
What ties all of these methods together is intent: get a trusted tool onto the machine without raising alarms, then use it to operate freely.
Here’s where things get more complicated. Attackers aren’t just installing one RMM tool. They’re stacking them.
Huntress researchers documented a pattern they call daisy-chaining, where threat actors install a primary RMM tool first, then use it to quietly drop a second, and sometimes a third. The goal is redundancy. If security teams catch and remove one tool, the attacker still has a foothold through the others. It also fragments the activity across multiple telemetry sources, making it much harder for security teams to piece together what happened.
The consequences of a successful intrusion are severe. Huntress found that over 50% of incidents involving suspicious Atera RMM activity led directly to ransomware. And when RMM tools are involved, that ransomware can deploy in as little as an hour or two after initial compromise. There is very little time to catch it.
This threat isn’t targeting enterprises alone. Huntress was explicit: RMM abuse hits every level, including small and medium-sized businesses.
SMBs are often running RMM tools provided by their MSP. That relationship involves a high level of inherent trust, which is exactly what attackers look to exploit. A trojanized tool or a rogue installer that mimics a known product can slip past employees who aren’t looking for anything suspicious. Why would they be? They’re used to software being pushed to their machines by IT.
There’s also the detection problem. Most SMBs don’t have the internal security resources to monitor RMM activity closely. Without a defined list of approved tools and endpoint visibility, a rogue RMM installation can sit undetected for weeks.
The good news is that defenses exist. They require some discipline, but they’re achievable even for smaller organizations.
Know what’s approved. Build an explicit inventory of every RMM tool that’s sanctioned in your environment, including the specific versions and the IP addresses or domains they should be communicating with. Anything outside that list should trigger an alert.
Treat unknown RMM activity as suspicious by default. The guidance is clear: don’t assume an unrecognized RMM tool is benign just because it’s a commercial product. If it wasn’t deployed by your IT team, it shouldn’t be there.
Watch for early warning signs. Multiple simultaneous logins from different geographic locations, connections to newly registered domains, and RMM processes launching from temp or user-writable directories are all red flags. So is an incident response plan that doesn’t account for RMM-based intrusions.
Train your people. Employees don’t need to understand the technical details to avoid a phishing lure or a suspicious download. But they do need to know that phishing awareness training matters, and that unsolicited software installs should always raise questions.
Work with a vetted MSP. Not all managed service providers take the same approach to security. Ask your provider how they control and audit RMM access, how they handle managed security services, and what monitoring is in place to detect unauthorized remote access tools in your environment.
RMM abuse isn’t really a tooling problem. It’s a trust problem. Attackers are succeeding because these tools are granted implicit trust by default, and that trust isn’t being verified.
For SMBs, the lesson is straightforward. Knowing that your IT team uses certain tools isn’t enough. You need visibility into what’s running in your environment, who put it there, and what it’s connecting to. Without that, the very software designed to help manage your systems could quietly become the thing that brings them down.
If you’re not sure whether your environment is protected against RMM abuse, reach out to Gibraltar Solutions. We can help you understand your exposure and put the right controls in place.
