Topic
Attackers' use of legitimate remote monitoring and management tools (e.g. ScreenConnect, MSP360, ManageEngine) for persistence and control after compromise.
Huntress tied one rogue ScreenConnect configuration from a Power BI phishing campaign to 22 more endpoints across separate incidents. For defenders, the thing to hunt is a ScreenConnect client their own IT never deployed.
Reality
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
Any.Run's researchers found a phishing kit running in 46 countries whose final payload is a signed copy of ScreenConnect or GoTo Resolve, which moves the defensive question from malware signatures to which remote-access tools may execute at all.
Reality
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
Huntress says three of its SOC investigations began with document lures and ended with victims installing rogue ITarian and ScreenConnect clients, and its responders now find RMM abuse in almost 40% of the incidents they work.
Reality
Unit 42 traced two campaigns that open with a Teams chat and an immediate voice call from an external tenant, which puts the question of who can ring your staff in the same bucket as who can sign in as them.
Reality
Proofpoint's PackClient writeup describes a chain whose only attacker-supplied executable on disk is a DLL, and whose persistence arrives as a real ManageEngine agent. That leaves the detection sitting on load-event correlation and egress control.
Reality