SecuriTricks

Email-Delivered RMM: Abusing PDFs for Silent Initial Access

A targeted campaign has been observed since November 2024, primarily affecting organizations in France and Luxembourg. The attackers use socially engineered emails to deliver PDF documents containing embedded links to Remote Monitoring and Management (RMM) tool installers. This method bypasses many…

phishing

social engineering

Published: August 7, 2025

Downloadable IOCs: 51

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazili…

dropbox

rmm

spam

initial access broker

Published: May 8, 2025

Downloadable IOCs: 26

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft,…

Published: March 12, 2025

Downloadable IOCs: 15

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

A sophisticated breach was identified where threat actors exploited vulnerabilities in SimpleHelp's Remote Monitoring and Management client to infiltrate a network. The attack involved post-compromise tactics including network discovery, administrator account creation, and persistence establishment…

Published: February 7, 2025

Downloadable IOCs: 6

The Abuse of ITarian RMM by Dolphin Loader

This report explores how the Dolphin Loader, a malware-as-a-service loader, abuses the legitimate ITarian Remote Monitoring and Management (RMM) software to distribute various malware payloads. The loader leverages the built-in functionality of RMM tools, such as remote command execution and system…

Published: August 19, 2024

Downloadable IOCs: 24

Tag: rmm

Attack reports

Email-Delivered RMM: Abusing PDFs for Silent Initial Access

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

The Abuse of ITarian RMM by Dolphin Loader