Tag: rmm

8 Attack Reports | 0 Vulnerabilities

Attack reports

Security brief: tax scams aim to steal funds from taxpayers

Threat actors are exploiting tax season with numerous campaigns leveraging tax themes to deliver malware, remote monitoring tools, fraud attempts, and credential phishing. Over a hundred campaigns have been observed in 2026, with a notable increase in remote monitoring and management (RMM) payloads…

social engineering

credential theft

irs impersonation

Published: March 30, 2026

Downloadable IOCs: 5

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

A newly discovered loader called SILENTCONNECT is being used in active campaigns to silently install ScreenConnect, a remote monitoring and management tool, on victim machines. The infection chain begins with users being redirected to a Cloudflare Turnstile CAPTCHA page disguised as a digital invit…

peb masquerading

Published: March 19, 2026

Downloadable IOCs: 10

Signed malware impersonating workplace apps deploys RMM backdoors

Multiple phishing campaigns were identified using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The attacks used digitally signed executables masquerading as legitimate software to install remote monitoring and management (RMM) tools like Scre…

lateral movement

digital signatures

workplace impersonation

Published: March 4, 2026

Downloadable IOCs: 20

Email-Delivered RMM: Abusing PDFs for Silent Initial Access

A targeted campaign has been observed since November 2024, primarily affecting organizations in France and Luxembourg. The attackers use socially engineered emails to deliver PDF documents containing embedded links to Remote Monitoring and Management (RMM) tool installers. This method bypasses many…

social engineering

Published: August 7, 2025

Downloadable IOCs: 51

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazili…

initial access broker

Published: May 8, 2025

Downloadable IOCs: 26

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft,…

email campaigns

Published: March 12, 2025

Downloadable IOCs: 15

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

A sophisticated breach was identified where threat actors exploited vulnerabilities in SimpleHelp's Remote Monitoring and Management client to infiltrate a network. The attack involved post-compromise tactics including network discovery, administrator account creation, and persistence establishment…

lateral movement

Published: February 7, 2025

Downloadable IOCs: 6

The Abuse of ITarian RMM by Dolphin Loader

This report explores how the Dolphin Loader, a malware-as-a-service loader, abuses the legitimate ITarian Remote Monitoring and Management (RMM) software to distribute various malware payloads. The loader leverages the built-in functionality of RMM tools, such as remote command execution and system…

malware-as-a-service

Published: August 19, 2024

Downloadable IOCs: 24

Click here to see more Attack Reports