Microsoft has reported observing phishing campaigns that are leveraging legitimate Remote Monitoring and Management (RMM) tools to establish persistent access to victim systems. Specifically, the campaigns were noted to abuse MSP360 RMM to facilitate the deployment of ScreenConnect, a legitimate remote desktop solution. This tactic creates redundant remote-access channels, enabling attackers to maintain control for subsequent malicious activities.
The reported attack chain begins with phishing, a common initial vector for many cyberattacks. Once a victim is successfully phished, likely leading to the compromise of credentials or the execution of a malicious payload, the attackers pivot to abusing RMM software. MSP360 RMM, a legitimate tool designed for IT professionals and Managed Service Providers (MSPs) to manage client systems remotely, is reportedly being used by the attackers. This abuse involves deploying ScreenConnect, another legitimate remote access tool, onto the compromised systems.
The deployment of ScreenConnect via MSP360 RMM is significant because it establishes a secondary, often redundant, channel for remote access. This redundancy is a key characteristic of advanced persistent threats (APTs), as it provides attackers with multiple pathways to regain access even if one method is detected and remediated. For instance, if the initial phishing-derived access is revoked, the ScreenConnect installation could still allow attackers to maintain a foothold.
Products in the RMM category are designed to provide extensive control over endpoints, including software installation, system configuration, and remote desktop capabilities. Their legitimate use by IT administrators makes their traffic and processes less likely to be flagged as immediately suspicious by conventional security tools, especially if the attackers are using valid credentials obtained through phishing. This makes them attractive targets for abuse by malicious actors seeking to blend in with legitimate network activity.
Mitigation for this class of attack typically involves a multi-layered approach. Strong email security solutions are crucial to detect and block phishing attempts at the outset. Endpoint detection and response (EDR) solutions can help identify the unauthorized deployment of legitimate software like ScreenConnect or unusual activity associated with RMM tools. Furthermore, robust identity and access management (IAM) practices, including multi-factor authentication (MFA) for all remote access and administrative accounts, are essential to prevent credential compromise from leading to widespread system access. Regular security awareness training for employees is also vital to reduce the success rate of phishing campaigns.
This observed activity underscores a broader trend in cybersecurity where threat actors increasingly weaponize legitimate tools and services to achieve their objectives. By abusing RMM platforms and remote desktop solutions, attackers can bypass traditional security controls that might be configured to trust such applications. This strategy allows them to maintain stealth and persistence, complicating detection and response efforts for organizations and highlighting the need for continuous monitoring and a deep understanding of legitimate software behavior within an enterprise environment.
