TLDR Tech / InfoSec
Daisy-Chaining Rogue RMM Tools: How Threat Actors Abuse Remote Management Software for Initial Access
Huntress documented a 277% surge in RMM abuse, with threat actors daisy-chaining tools like Action1 and ScreenConnect via MSI installers, wscript, and LLM-generated infostealer scripts to fragment telemetry, distribute persistence, and complicate attribution across campaigns targeting financial accounts and SSA-themed lures. Post-access tradecraft included pin.exe masquerading as Windows Security to harvest login PINs to ScreenConnect\Temp\output.txt, Sordum's HideUL.exe to conceal RMM installs from Add/Remove Programs, and WebBrowserPassView to harvest credentials, with C2 notifications routed through Telegram bots. Defenders should allowlist approved RMM tools explicitly, treat unrecognized RMM activity as suspicious by default, monitor for unexpected MSI installations from user-writable paths, and reference lolrmm.io for visibility into commonly abused platforms.
Read the full story