Remote monitoring and management (RMM) software lets IT teams control endpoints at scale: pushing patches, running scripts, and fixing machines they never physically touch. It has also become one of the most common footholds in recent breaches. The tools are legitimate, signed, and already trusted by the systems they run on, so an attacker who gets hold of one inherits deep access without tripping much on the way in.
This shows up two ways. An attacker either exploits an RMM the organization already runs, or phishes a user into installing one of their own. Either route ends in the same place: high privilege, remote control, and a short path to ransomware.
What RMM Is, and Why Attackers Reach for It
RMM software gives administrators remote control over endpoints at scale: deploying software, running diagnostics, executing commands, and managing machines they may never physically touch. Products like ConnectWise ScreenConnect, SimpleHelp, and BeyondTrust Remote Support are standard in IT and MSP environments. They are built to have deep, privileged access to the systems they manage, because that is the job.
That access is the appeal for an attacker. Microsoft’s threat researchers make the distinction directly in their write-up on RMM exploitation: RMM is not just remote access, it is remote privilege. Compromising one of these tools hands an intruder the same broad control an administrator has, right away.
Security products rarely flag the activity, which is the second half of the problem. A signed RMM binary carries no malicious signature, and behavioral tools that watch for unusual processes are often tuned to ignore common IT software so they don’t generate noise. An attacker working through a trusted agent blends into the traffic defenders have taught themselves to skip. It is the same trusted-tool blind spot that makes built-in system binaries a favorite for attackers, except here the tool is an installed agent rather than something native to the OS.
Two Ways In: Exploiting Yours, or Installing Theirs
The first pattern is exploiting an RMM the organization already runs. Across 2024 and 2025, attackers weaponized a run of vulnerabilities in widely used platforms, using them for initial access, lateral movement, and ransomware. The ScreenConnect authentication-bypass flaw tracked as CVE-2024-1709 kicked off one of the more damaging waves, and Microsoft observed the exploitation of zero-day vulnerabilities across multiple RMM platforms as part of coordinated, hands-on intrusions.
The second pattern needs no vulnerability at all. An attacker phishes an employee into installing or updating remote-access software, and once the user clicks, there is a legitimate, signed agent running on the machine with no exploit involved. Because the binary is valid and the traffic looks routine, it can sit undetected for a long time. The VENOMOUS#HELPER campaign used exactly this method, staying inside more than 80 organizations for over a year by installing trusted RMM tools rather than malware.
An attacker-installed RMM chain usually runs like this:
- A phishing email pushes the user to install or update remote-support software
- The signed agent runs and calls out to attacker-controlled infrastructure
- Internal reconnaissance maps the network and picks out valuable systems
- A second RMM tool is quietly dropped for redundancy and persistence
- A hidden administrator account is created to lock in long-term access
Once any of that is running, the attacker has a stable foothold that looks, to most monitoring, like a busy IT department doing its job.
Why It Escalates So Quickly
The reason RMM compromise turns serious so fast is privilege. These tools already run with high rights, so an attacker who controls one skips the slow work of escalating from a low-privileged foothold. They inherit the access on arrival, which shortens the path to full network control. Once an intruder has that kind of standing access, lateral movement follows quickly, often in minutes rather than days.
Detection evasion compounds it. Because the activity flows through trusted software, the usual tripwires stay quiet while the attacker runs reconnaissance, disables defenses, and stages payloads. Microsoft documented intruders who, once inside, rapidly escalated privileges, moved laterally, and set up environments for ransomware.
Persistence is the third piece. Attackers often run more than one RMM tool at a time, so pulling one still leaves another in place. Microsoft noted cases where intruders downloaded and executed a second RMM tool specifically for persistence, usually alongside a hidden admin account. By the time anyone notices something is off, the ransomware stage is close behind.
Why MSPs Carry More Risk
For an MSP, the RMM platform is the business. One management console reaches every client endpoint under contract, which is efficient and also the largest single point of failure imaginable. Compromise that console, or drop a rogue agent onto a managed machine, and the blast radius is not one company, it is the whole client base at once.
The Kaseya VSA incident of 2021 is still the clearest example. Attackers exploited the VSA platform to push what looked like a routine update, and the malware cascaded through MSPs to their downstream customers, hitting well over a thousand organizations in a single operation. CISA and the FBI issued joint guidance for MSPs and their customers, and one of the core recommendations was to limit RMM communication to known IP address pairs.
The pattern has continued. CISA’s 2025 advisory on SimpleHelp describes ransomware actors targeting organizations through unpatched versions of the tool, and warns specifically that a compromised RMM used by a service provider becomes a route into every downstream customer it touches. For an MSP, the security of a management tool cannot be separated from the security of every client depending on it.
What Limits the Damage
Start with visibility: know which remote-management tools are approved in your environment, and treat anything that isn’t on that list as suspect. If an RMM agent nobody authorized turns up on an endpoint, that should be something you can see and act on, not something lost in the noise.
The control that does the most work is removing standing local admin rights, because both abuse patterns lean on privilege. A phished user can only install a rogue agent if their account has the rights to do it, and an attacker exploiting an existing tool wants high privilege to escalate from.
Take away permanent local admin and require elevation per application, with every elevation logged. The silent install stops working, and unexpected remote-management software becomes something you can block and review. Admin By Request’s Endpoint Privilege Management solution grants privilege only when it is needed and keeps a full audit trail of what was elevated and by whom. For an MSP, that containment holds across every managed endpoint rather than depending on per-machine setup.
Removing standing privilege doesn’t replace patching your RMM promptly or watching for odd sessions at odd hours. It sits underneath those as a floor: even when a tool is compromised or a user is fooled, the lack of standing privilege caps how far the intrusion gets.
A Trusted Tool Is Still a Tool
RMM abuse is awkward precisely because the software acting as an entry point is doing what it was built to do. The trust that makes these tools useful is the same trust attackers borrow when they turn them against you.
You cannot remove that trust without giving up the productivity these tools provide, but you can contain what happens when it is abused. Controlling privilege at the endpoint, keeping visibility over what remote-management software is allowed to run, and logging every elevation together shrink the gap between a compromised tool and a company-wide ransomware event.
To see how endpoint privilege control fits into that picture, you can try our EPM solution on the free plan, which gives you access to the full feature set for up to 25 endpoints. It is a straightforward way to close the standing-admin gap so many of these attacks depend on.
