Living Off the Land:
RMM Tool Abuse

Remote Monitoring and Management (RMM) tools have become one of the most consistently abused classes of legitimate software in the modern threat landscape. Nation-state actors, ransomware syndicates, and financially motivated cybercriminals are systematically weaponizing tools like AnyDesk, ConnectWise ScreenConnect, and TeamViewer to bypass security controls, establish persistent access, and deliver devastating payloads. This report provides a comprehensive analysis of the threat, the actors involved, their methodologies, and actionable detection and defense strategies.

Executive Summary

The abuse of legitimate Remote Monitoring and Management (RMM) software represents one of the most significant and underappreciated threats to enterprise security today. Adversaries exploit the inherent trust that organizations place in these tools — trust rooted in their legitimate administrative purpose, their digitally signed binaries, and their ubiquitous presence in managed IT environments. This trust creates a systemic blind spot that threat actors of all sophistication levels are actively exploiting.

Between 2023 and 2025, Mjolnir Security has observed a marked escalation in RMM abuse across incident response engagements and threat intelligence collection. Threat actors ranging from the social-engineering-driven Scattered Spider collective to the PRC-backed VOLT TYPHOON pre-positioning campaign have weaponized RMM tools as core components of their operational tradecraft. The convergence of these diverse threat actors on a single class of tooling underscores the severity of the problem.

Background & Threat Landscape

RMM tools are designed to provide IT administrators and Managed Service Providers (MSPs) with remote access to endpoints for maintenance, troubleshooting, and monitoring. Their design characteristics, however, make them extraordinarily attractive to adversaries.

Why RMM Tools Are Attractive to Threat Actors

• Digitally signed binaries: RMM executables are signed by trusted vendors, allowing them to bypass application whitelisting, endpoint detection, and code signing enforcement policies.
• Encrypted communications: RMM tools use TLS-encrypted channels to vendor-controlled relay infrastructure, making network-based detection extremely difficult and blending malicious C2 traffic with legitimate administrative activity.
• Built-in persistence mechanisms: Most RMM agents install as Windows services or scheduled tasks by design, providing adversaries with automatic persistence that survives reboots without requiring custom implants.
• Full remote control capabilities: These tools provide interactive desktop access, file transfer, remote shell execution, and system management — the complete toolkit an attacker needs for hands-on-keyboard operations.
• Pre-existing trust relationships: In environments where RMM tools are already deployed, additional instances may not trigger alerts, as security teams expect to see RMM-related network traffic and process execution.
• MSP supply chain leverage: Compromising a single MSP's RMM platform can provide simultaneous access to hundreds or thousands of downstream client organizations, creating catastrophic blast radius potential.
• Minimal forensic footprint: Unlike custom malware, RMM tools are designed for low resource consumption and quiet background operation, reducing the likelihood of detection through behavioral anomaly analysis.

Threat Actor Profiles

The following profiles detail the most prominent threat actors observed abusing RMM tools in their operational campaigns. These actors span the full spectrum of adversary motivation — from financially driven cybercrime to state-sponsored espionage and pre-positioning for destructive operations.

Attack Methodology & Kill Chain

RMM tool abuse follows a consistent operational pattern across threat actors, though specific implementations vary by group. The following kill chain analysis maps observed behaviors across the full attack lifecycle.

Phase 1: Initial Access

• Phishing with RMM payloads: Adversaries deliver phishing emails containing links to portable RMM executables hosted on legitimate file-sharing services (OneDrive, Google Drive, Dropbox). The use of trusted hosting platforms bypasses URL reputation filtering.
• Social engineering of help desks: Scattered Spider and similar actors call IT help desks impersonating employees, convincing support staff to reset credentials or enroll attacker-controlled MFA devices, then use legitimate credentials to install RMM agents.
• Exploitation of internet-facing infrastructure: Actors exploit VPN appliances (Cisco, Fortinet, SonicWall), RDP gateways, or web application vulnerabilities to gain initial foothold, then deploy RMM tools for stable, interactive access.
• MSP platform compromise: Attackers compromise MSP administrative portals through credential stuffing, password spraying, or exploitation of platform vulnerabilities, gaining the ability to deploy RMM agents across all managed clients.
• Trojanized software distribution: Lazarus Group and similar actors distribute trojanized applications through professional networking platforms or compromised software supply chains, bundling legitimate RMM tools with custom malware payloads.

Phase 2: Execution & Persistence

• Portable executable deployment: Adversaries deploy portable (non-installed) versions of AnyDesk, ScreenConnect, or other RMM tools that do not require administrative privileges or create installation artifacts, running directly from user-writable directories.
• Service installation: When elevated privileges are available, actors install RMM tools as Windows services (e.g., AnyDesk service, ScreenConnect Client service) for automatic startup persistence.
• Scheduled task creation: RMM binaries are registered via Windows Task Scheduler to execute at system startup or on recurring intervals, ensuring persistence even if the running process is terminated.
• Registry run key modification: Actors add RMM executable paths to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or equivalent HKCU keys for user-level persistence.
• Multi-tool redundancy: Sophisticated actors deploy multiple RMM tools simultaneously (e.g., AnyDesk + ScreenConnect + Atera) to ensure persistent access even if one tool is detected and removed.

Phase 3: Command & Control

• Vendor relay infrastructure: RMM tools communicate through vendor-operated relay servers (e.g., *.net.anydesk.com, *.screenconnect.com), making C2 traffic appear as legitimate administrative activity. Blocking these domains may disrupt legitimate IT operations.
• TLS-encrypted channels: All major RMM tools use TLS encryption for communications, preventing content-based network inspection from identifying malicious commands or exfiltrated data.
• Custom relay servers: Advanced actors (Lazarus Group) configure modified RMM clients to communicate with attacker-controlled relay infrastructure, eliminating dependence on vendor servers while maintaining the appearance of legitimate RMM traffic.
• Port flexibility: RMM tools operate on standard ports (443, 80) and can be configured to use custom ports, allowing actors to adapt to network restrictions and blend with normal web traffic.

Phase 4: Lateral Movement

• Credential harvesting: Once interactive access is established via RMM, actors deploy credential dumping tools (Mimikatz, ProcDump of LSASS, comsvcs.dll MiniDump) to harvest domain credentials for lateral movement.
• RMM propagation: Actors use existing RMM access to deploy additional RMM agents on other systems in the environment, expanding their access footprint across the network.
• RDP pivoting: Harvested credentials are used for RDP lateral movement, with RMM tools serving as the stable C2 channel through which RDP sessions are initiated and managed.
• Administrative tool abuse: Actors leverage RMM-provided shell access to use built-in Windows tools (PsExec, WMIC, PowerShell Remoting) for lateral movement that blends with normal administrative activity.

Phase 5: Impact

• Ransomware deployment: Compromised RMM platforms are used to push ransomware payloads simultaneously across all managed endpoints, maximizing impact and minimizing response time. PDQ Deploy and similar tools are abused for mass deployment.
• Data exfiltration: RMM file transfer capabilities are used for data exfiltration, or actors deploy supplementary tools (Rclone, MEGAsync, WinSCP) through RMM access to exfiltrate data to attacker-controlled cloud storage.
• Security tool disabling: Actors use elevated RMM access to disable, uninstall, or tamper with endpoint security products, SIEM agents, and logging infrastructure before deploying final payloads.
• Destructive operations: VOLT TYPHOON-style actors use persistent RMM access for pre-positioning, maintaining dormant access that can be activated for disruptive or destructive operations during geopolitical crises.

MITRE ATT&CK Mapping

The following table maps observed RMM abuse behaviors to the MITRE ATT&CK framework, providing technique-level detail for detection engineering and threat modeling.

Indicators of Compromise

The following IOCs are associated with observed RMM abuse campaigns. These indicators should be integrated into SIEM correlation rules, endpoint detection policies, and network monitoring infrastructure.

Detection Strategies

Effective detection of RMM abuse requires a layered approach combining SIEM correlation, endpoint behavioral analysis, and network traffic monitoring. The following strategies are designed to identify unauthorized RMM tool deployment and usage while minimizing false positives from legitimate IT operations.

SIEM Detection Rules

_sourceCategory=endpoint/process
| where process_name in ("AnyDesk.exe","ScreenConnect.ClientService.exe",
    "TeamViewer.exe","rustdesk.exe","Splashtop*.exe","atera_agent.exe")
| where !(process_path matches "C:\\Program Files*")
    AND !(process_path matches "C:\\Program Files (x86)*")
| count by hostname, process_name, process_path, user
| where _count > 0
| sort by _count desc

_sourceCategory=endpoint/network
| where dest_port in ("7070","5938","8040","443","21166","4343")
| where process_name in ("AnyDesk.exe","ScreenConnect.ClientService.exe",
    "TeamViewer.exe","rustdesk.exe")
| parseDate(event_time) as event_ts
| formatDate(event_ts,"HH") as hour_of_day
| where hour_of_day < "06" OR hour_of_day > "22"
| count by hostname, process_name, dest_ip, dest_port, user
| sort by _count desc

Endpoint Detection Rules

• Unapproved RMM installation: Alert on Windows service creation (Event ID 7045) for any RMM tool not in the organization's approved software inventory. Maintain an allowlist of sanctioned RMM tools and alert on any deviation.
• Portable RMM execution: Flag execution of RMM executables from user-writable directories (Downloads, Temp, Desktop, AppData) rather than Program Files, indicating portable deployment without formal installation.
• Multiple RMM tools: Alert when more than one distinct RMM tool is detected on a single endpoint within a 24-hour window. Legitimate environments rarely require multiple concurrent RMM platforms on individual systems.
• RMM + credential tool correlation: Correlate RMM process execution with subsequent execution of credential dumping tools (Mimikatz, ProcDump targeting LSASS, comsvcs.dll) within a defined time window.
• RMM persistence creation: Monitor for creation of new scheduled tasks, services, or registry Run keys referencing RMM tool executables, particularly when created outside of approved change windows.

Network Detection

• RMM relay domain monitoring: Log and alert on DNS queries to RMM vendor relay domains (*.net.anydesk.com, *.screenconnect.com, *.teamviewer.com) from endpoints where those tools are not approved for use.
• Non-standard port detection: Monitor for RMM-associated traffic on unexpected ports, particularly when RMM tools are configured to use non-default ports to evade detection.
• TLS certificate analysis: Inspect TLS certificate metadata for connections to RMM relay infrastructure, identifying connections that use RMM vendor certificates from endpoints without approved RMM installations.
• Traffic volume anomalies: Baseline normal RMM traffic volumes and alert on significant deviations, which may indicate data exfiltration through RMM file transfer capabilities.
• Geolocation analysis: Flag RMM relay connections that terminate in geographic regions inconsistent with the organization's IT operations or MSP provider locations.

Recommendations

Immediate Actions (0-30 Days)

1. Audit all RMM tools: Conduct an immediate inventory of all RMM software installed across the environment. Identify and remove any unauthorized or unapproved RMM tools. Document the approved RMM tool(s) and establish a formal policy.
2. Implement application whitelisting for RMM: Configure application control policies to block execution of RMM tools not explicitly approved by the organization. Block portable/standalone RMM executables from running in user-writable directories.
3. Enforce MFA on all RMM platforms: Require multi-factor authentication for all administrative access to RMM management consoles. Disable SMS-based MFA in favor of FIDO2/WebAuthn hardware tokens or authenticator applications.
4. Deploy SIEM detection rules: Implement the detection queries provided in this report to identify unauthorized RMM installations, after-hours sessions, and anomalous RMM behavior patterns.
5. Review MSP access controls: If using a managed service provider, review and restrict their RMM access scope. Implement jump server requirements for MSP access and ensure all MSP sessions are logged and monitored.

Medium-Term Hardening (30-90 Days)

1. Network segmentation for RMM traffic: Restrict RMM relay communications to specific network segments and proxy through monitored chokepoints. Implement firewall rules that limit RMM relay connectivity to approved endpoints only.
2. Endpoint hardening: Disable unused remote access features (Remote Desktop, Remote Assistance, WinRM) on endpoints that do not require them. Apply attack surface reduction (ASR) rules to prevent abuse of built-in remote access capabilities.
3. Privileged access management (PAM): Implement PAM solutions for all administrative access, including RMM-based sessions. Require just-in-time (JIT) elevation for RMM administrative actions and maintain full session recording.
4. DNS filtering and monitoring: Deploy DNS security solutions that can identify and optionally block connections to RMM relay infrastructure from unauthorized endpoints. Maintain comprehensive DNS query logs for forensic analysis.
5. Help desk social engineering training: Implement enhanced identity verification procedures for help desk operations, including callback verification, manager approval for MFA resets, and voice biometric solutions where available.
6. Vulnerability management for RMM platforms: Prioritize patching of RMM platform vulnerabilities, particularly for self-hosted ConnectWise ScreenConnect, Kaseya VSA, and similar platforms. The ConnectWise ScreenConnect CVE-2024-1709 authentication bypass demonstrated the criticality of timely RMM patching.

Strategic Recommendations

1. Adopt Zero Trust for remote access: Transition from perimeter-based RMM access models to Zero Trust Network Access (ZTNA) architectures that enforce continuous authentication, device posture validation, and least-privilege access for every remote session.
2. RMM vendor consolidation: Reduce the number of approved RMM platforms to the minimum necessary. Each additional RMM tool increases the attack surface and complicates monitoring. Aim for a single, well-monitored RMM solution.
3. Threat-informed defense program: Establish a continuous threat intelligence program that tracks RMM abuse TTPs and translates emerging threat actor behaviors into updated detection rules, hunting hypotheses, and security control validations.
4. Purple team exercises: Conduct regular purple team exercises that simulate RMM abuse scenarios, testing the organization's ability to detect unauthorized RMM deployment, lateral movement via RMM tools, and ransomware deployment through compromised RMM platforms.
5. Supply chain risk management: Implement formal third-party risk management processes for MSPs and other providers with RMM access. Require contractual security obligations, regular security assessments, and incident notification requirements.

References

1. CISA, NSA, MS-ISAC. "Protecting Against Malicious Use of Remote Monitoring and Management Software." Joint Cybersecurity Advisory AA23-025A, January 2023.
2. Mandiant. "Scattered Spider: A Cyber Crime Group Targeting Telecoms and BPO Firms." UNC3944 Threat Report, 2023.
3. CISA. "People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection." Joint Advisory on VOLT TYPHOON, May 2023.
4. Huntress Labs. "ConnectWise ScreenConnect Authentication Bypass (CVE-2024-1709)." Threat Advisory, February 2024.
5. FBI, CISA. "Akira Ransomware Indicators of Compromise and Tactics, Techniques, and Procedures." Joint Advisory AA24-109A, April 2024.
6. Sophos. "The State of Ransomware 2024: RMM Tool Abuse in Ransomware Attacks." Annual Report, 2024.
7. CrowdStrike. "2024 Global Threat Report: Identity-Based Attacks and RMM Exploitation." Annual Threat Report, 2024.
8. MITRE ATT&CK. "T1219: Remote Access Software." MITRE Corporation, 2024.
9. CISA. "Kaseya VSA Supply-Chain Ransomware Attack." Alert AA21-188A, July 2021.
10. Microsoft. "VOLT TYPHOON targets US critical infrastructure with living-off-the-land techniques." Microsoft Threat Intelligence, May 2023.