Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
Huntress details phishing campaigns installing rogue ITarian and ScreenConnect RMM clients with SYSTEM persistence, amid a 277% spike in RMM abuse.
Huntress SOC investigated three incidents where phishing lures (a TransferXL secure-document email and fake ScreenConnect document shares) tricked employees into installing rogue RMM clients. Attackers stacked ITarian plus ScreenConnect for redundant SYSTEM-level persistence, ran defense-evasion binaries such as HideUL_x64.exe, and in one case used a client hidden for five months to set malicious inbox rules. Huntress tracked a 277% spike in RMM abuse in 2025 and now sees it in roughly 40% of incidents it investigates.
- Phishing lures deliver rogue RMM installers disguised as documents
- Stacked RMMs (ITarian, ScreenConnect) create redundant persistent access
- Defense evasion via HideUL_x64.exe during ScreenConnect sessions
- 277% spike in RMM abuse tracked in 2025; ~40% of Huntress incidents
- One rogue ScreenConnect client went undetected for five months
- ATT&CK
- T1566.002 Spearphishing LinkT1219 Remote Access SoftwareT1562.001 Impair DefensesT1137.005 Office Application Startup: Mail Rules
- Organizations
- HuntressITarianScreenConnectTransferXLAdobe
From the original article
5 min read at huntress.comThe Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.