Remote monitoring and management (RMM) software is legitimate IT tooling—but its ability to control computers remotely can also help an intruder blend in. Attackers may trick someone into installing an approved tool, misuse an agent already present, or exploit a vulnerability in an RMM platform. Those are different routes into an organization, and an RMM tool’s presence by itself does not prove a compromise. The key questions are whether its installation and use were authorized, how it arrived, which account installed it, and what happened next.
Why RMM software can look like ordinary IT activity
Organizations use RMM tools to monitor endpoints and provide remote support. Depending on the product and configuration, an operator may be able to run commands, deploy software, transfer files, or maintain access through a service. Those capabilities help administrators support devices; after an attacker gains a foothold, they can also help the attacker control a device or extend access.
As an Amazon Associate I earn from qualifying purchases.
MITRE ATT&CK classifies adversary use of legitimate remote desktop software as T1219.002, Remote Desktop Software, within its Remote Access Tools technique family. The technique description notes that an adversary may use legitimate desktop-support software to establish an interactive command-and-control channel. MITRE’s page metadata lists version 1.0 and a last modification date of May 12, 2026.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →This dual use changes how a security team should interpret an alert. Seeing a recognizable RMM agent is a reason to check its context, not a verdict. The same product might have arrived through an approved IT deployment or through a deceptive download initiated by an employee.
#1 Best Overall
How attackers get RMM tools onto a device
Social engineering and deceptive installation requests
A common pattern is to persuade a person to install a real remote-support product, then use it to control the device and bring in additional tools. The request may be dressed up as a familiar business task: a meeting invitation, document portal, software update, tax form, job offer, package notice, or helpdesk interaction. A plausible theme does not make the requested installation legitimate.
Microsoft reported on September 29, 2026, that phishing campaigns it observed in July targeted organizations across multiple industries. Lures included meeting requests, prompts to install Zoom or Google Meet, Adobe or PDF updates, invitations, job offers, document review, and package-delivery themes. The lures led to a signed MSP360 RMM installer using deceptive filenames. After successful User Account Control (UAC) elevation, the installer set up services for persistence; the RMM agent then invoked PowerShell and silently installed ConnectWise ScreenConnect as a second remote-access channel. Microsoft described subsequent information collection, credential-access operations, and deployment of additional utilities. It did not attribute the activity to a named threat actor. [Microsoft Threat Intelligence, September 29, 2026]
Microsoft said it did not observe exploitation of ScreenConnect itself in that activity. In other words, ScreenConnect was used as a tool after the lure-driven installation chain; that is not the same as an attacker exploiting a ScreenConnect vulnerability.
The same report described delivery through attacker-controlled infrastructure, sites assessed to be compromised, and legitimate cloud-hosted services. A signed installer or familiar hosting service alone cannot establish that a download is safe: the download’s source, the reason it was requested, whether it belongs in the software inventory, and the execution context all matter.
Campaigns reported in other periods
In a separate report published March 19, 2026, Microsoft described tax-themed campaigns distributing ScreenConnect, SimpleHelp, and Datto. It reported several hundred emails in one US campaign, several thousand in another, and approximately 1,000 emails in a campaign aimed at US recipients in accounting and related organizations. These are counts from the specific campaigns Microsoft described, not estimates of how often RMM abuse occurs overall. [Microsoft Threat Intelligence, March 19, 2026]
Earlier, a joint CISA, NSA, and MS-ISAC advisory dated January 25, 2023, summarized a 2022 refund-scam campaign in which phishing emails prompted victims to install legitimate ScreenConnect—then called ConnectWise Control—and AnyDesk. That is useful historical context, not evidence that the same campaign is active now. [CISA, NSA, and MS-ISAC advisory AA23-025A]
Rank #3
Exploitation of an RMM vulnerability
Attackers can also gain access by exploiting a vulnerability in an RMM platform. This route is distinct from tricking a user into installing legitimate software or abusing an authorized deployment. A CISA advisory summary describes exploitation of SimpleHelp in a separate ransomware context; the available details here support that distinction, but not a broader account of the incident. [CISA cybersecurity advisories]
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep these pathways separate during triage. A suspicious agent installation calls for questions about delivery, authorization, and the installing account. Suspected exploitation calls for examining the platform, its exposure, and relevant vulnerability information. One finding does not establish the other.
How to judge whether an RMM deployment is legitimate
Compare what you observe with the organization’s approved tools, deployment methods, change records, and support activity. The product name alone is weak evidence because the same tool may be used legitimately or maliciously. Context and behavior make the difference.
| What to check | More consistent with authorized support | Reasons to investigate |
|---|---|---|
| Approval and inventory | The tool, device, vendor, and support purpose match the organization’s approved inventory and change records. | The tool is unknown, newly installed without a matching change, or outside the approved deployment path. |
| Initiator and account | The installation and session correspond to an expected administrator or support team. | An unexpected user initiated the installation, or a system-level account was used in a way the organization cannot explain. |
| Arrival and request | The software came through the expected management channel for a documented support task. | It followed an unsolicited meeting, document, update, tax, delivery, or helpdesk request—or came from an unexpected download source. |
| Execution and follow-on activity | Observed actions fit the support task and the organization’s normal process. | Unexpected elevation, persistence, command execution, file transfer, PowerShell activity, a second remote-access tool, or credential-access activity follows. |
These are investigative signals, not a complete forensic playbook. The evidence available depends on local endpoint, identity, and network telemetry. An unexplained installation deserves attention even if the agent is signed or familiar; an authorized deployment still merits scrutiny if its behavior departs from the expected task.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations can do to reduce RMM abuse
Make authorization explicit
- Maintain an inventory of approved RMM products, users and teams allowed to install agents, vendors, and permitted deployment paths.
- Restrict installation rights where practical, and record changes so responders can distinguish planned support from an unexpected deployment.
- Require multifactor authentication (MFA) for approved RMM systems where the product and environment support it.
Control which tools can run
Use application control to block unapproved IT-management tools or unapproved signed instances. Microsoft specifically discusses Windows Application Control and AppLocker publisher rules as options. Test rules for compatibility and operational impact before broad enforcement: overly restrictive controls can disrupt legitimate support, while loose rules may leave room for unauthorized software.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Investigate the account and the activity
If an unauthorized RMM installation is found, investigate the associated installation account and reset credentials used to install the service when warranted. Microsoft notes that use of a system-level account may call for further investigation. Review what commands or files followed, whether the installer was elevated, whether the agent established persistence, and whether another remote-access tool appeared. Use endpoint protection and relevant attack-surface-reduction controls, and investigate suspicious remote-management or credential-access behavior rather than treating the executable as the whole incident. [Microsoft Threat Intelligence, September 29, 2026]
Best Value
What the published statistics do—and do not—show
Older figures indicate that defenders have encountered RMM tools in intrusion activity, but they are not current prevalence estimates for all organizations. Microsoft’s 2023 Digital Defense Report said known RMM tools were involved in 17 percent of intrusions handled by its incident responders. That figure describes Microsoft’s responder cases, not every incident or organization. [Microsoft Digital Defense Report 2023]
CrowdStrike’s 2024 Threat Hunting Report, released August 20, 2024, reported a 70 percent increase in RMM tool abuse and said RMM tool exploitation accounted for 27 percent of hands-on-keyboard intrusions in its defined dataset. The press-release finding does not state the comparison baseline for the 70 percent figure, so it should not be read as a universal growth rate. Neither statistic establishes how common RMM compromise is in a particular organization today. [CrowdStrike, 2024 Threat Hunting Report announcement]
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
