N-able ships N-central hotfix after 33 Able2Shell flaws go public
Build 2026.4.1.26 patches seven CVEs and disables remote control, while proof-of-concept code for all 33 issues stays public.
Stories per day · 30 days
3 RSS
Relatedn-able12n-central12remote-code-execution7able2shell6xxe6zero-day4proof-of-concept3ransomware3social-engineering3clickfix2microsoft-teams2phishing2privilege-escalation2screenconnect2adversary-in-the-middle1ai-cybercrime1black-basta1business-email-compromise1
50 stories, newest first · one card per story
Stories tagged #rmm
N-able takes hosted N-central offline after Able2Shell PoC release
A researcher published proof-of-concept code for 33 issues, including unauthenticated RCE; N-able reports scanning but no confirmed compromises.
N-able warns of scanning for critical N-central flaws after public PoC
Hotfix 2, build 2026.4.1.26, covers seven CVEs, including path-traversal remote code execution CVE-2026-125882.
N-able releases N-central 2026.4 HF2 for publicly disclosed zero-days
Defused saw internet probing of the flaws; Shadowserver counts about 148 exposed servers, down from 1,338.
N-able hotfixes seven N-central CVEs after Able2Shell proof-of-concept
A researcher published proof-of-concept code for 33 alleged flaws; N-able says hosted servers are upgraded and no customer compromise is confirmed.
N-able ships N-central emergency fix after 33 exploits published
Hosted N-central was taken offline worldwide, and on-premises customers were told to shut servers down until 2026.4 HF2.
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
1
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
2
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
1
Malicious calendar invites surge, stealing Microsoft logins and pushing ScreenConnect
Check Point counted more than 740,000 such emails in the first two weeks of October, up from a few thousand a month in April.
1
Ransomware at Machine Speed: How GenAI Shrinks the Path after Initial Access
Zscaler says GenAI helps ransomware crews phish better, find sensitive data faster, and build evasive custom scripts.
2
What Cybersecurity Leaders Must Prioritize in 2027
Huntress urges leaders to prioritize RMM abuse, AI-enabled crime, social-engineering loaders, and multi-extortion ransomware.
Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Huntress found a Power BI phishing campaign that installs rogue ScreenConnect clients for persistent Windows access.
Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access
Phishers abused Microsoft Power BI dashboards to push rogue ScreenConnect RMM clients, creating redundant persistent remote access on 20-plus endpoints.
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Huntress reports phishing that abuses Microsoft Power BI links to install rogue ScreenConnect RMM clients.
How to secure RMM software: 8 controls MSPs should test
An Acronis-backed checklist tells MSPs to test eight RMM controls, citing N-able and SharePoint flaws.
More RMM Tools In the Wild, (Tue, Oct 6th)
Attackers phish victims with a fake PDF that installs Action1’s signed RMM agent for persistence.
Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing
Phishers sent a fake payment notice that installed a legitimate ScreenConnect client aimed at their server.
5
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
Attackers phish victims into running a signed ScreenConnect client that calls an attacker instance.
2
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Phishing campaigns abuse signed MSP360 installers to deploy ScreenConnect and establish dual remote-access footholds.
Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs
Hackers phish employees with fake Zoom and PDF installers that deploy signed MSP360 and ScreenConnect access.
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
US-focused CSuite phishing steals Microsoft 365 sessions and installs RMM tools for persistent access.
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed July 2026 phishing campaigns that installed MSP360 RMM and ScreenConnect for persistent access across industries.
Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud
September campaigns CSuite, N0va, and IronToll phished US organizations for Microsoft 365 sessions, tokens, and payment data.
6