Abuse of RMM Tools in Recent Phishing Campaigns

Phishing campaigns have evolved, leveraging diverse tools to enhance their efficacy and reach. The latest trend identified by SANS ISC involves the exploitation of Remote Management and Monitoring (RMM) tools, such as ScreenConnect, in phishing attacks. These tools, traditionally used for legitimate administrative tasks, are co-opted by threat actors to achieve stealthy persistence and control over compromised systems.

Campaign or TTP Overview

According to the insightful report by SANS ISC, a significant uptick in phishing campaigns abusing RMM tools was observed. These operations, attributed primarily to financially motivated threat groups, emerged around Q2 2023 and targeted industries ranging from healthcare to finance. The attackers utilized RMM tools to create a façade of IT support, tricking users into unwittingly granting access to their systems.

These campaigns predominantly targeted organizations in the United States and Europe. By impersonating legitimate IT services, threat actors successfully overcame initial skepticism and secured a foothold within targeted environments. This approach not only enhanced the persistence of their operations but also minimized detection by leveraging tools that are typically not flagged by traditional antivirus solutions.

RMM tools like ScreenConnect, TeamViewer, and AnyDesk became the focal point of these schemes. By manipulating the trust and accessibility features inherent in these platforms, attackers crafted a calculated approach to escalate their access privileges and harvest sensitive information.

How It Was Built

The campaigns began with phishing emails that mimicked legitimate IT support requests. These emails typically included a sense of urgency, persuading the recipient to follow instructions immediately. A common subject line used was:


Subject: Immediate Action Required: New IT Support System Installation

The delivery mechanism involved personalized emails with malicious attachments or links directing recipients to a spoofed IT service portal. The integration of RMM tools was not overt; instead, attackers leveraged legitimate-looking domains and SSL certificates to enhance credibility.


https://it-support[.]company-name[.]com

Upon clicking the link, victims were prompted to install an RMM client under the guise of a required update. The payload was crafted to appear as an official application update, often branded with the company’s logo and professional language to instill trust. Once the RMM tool was installed, attackers gained remote access, allowing them to execute commands, extract data, and conduct further reconnaissance.

Why It Worked

The effectiveness of this campaign stemmed from several key elements:

Plausible Lure Content: The lure emails were meticulously crafted to mirror internal IT communications. By embedding urgency and executive mention, these emails bypassed user skepticism, prompting rapid engagement.
Use of Legitimate Tools: RMM tools like ScreenConnect are widely used for actual IT support, lending inherent credibility. Attackers leveraged this by creating a familiar interaction, reducing victim defenses.
Visual Authenticity: Using legitimate-looking domains and SSL certificates, attackers effectively disguised their operations as authentic internal processes. The visual trust indicators typically inspected by users, such as SSL padlocks, were weaponized to reinforce deception.

Operator Takeaways

For red teamers seeking to emulate this sophistication, there are critical aspects to incorporate into your simulated phishing campaigns:

Brand Integration: Ensure that your lures include familiar branding and tone consistent with internal communications. Use visual and cognitive cues familiar to the target to drop their defenses.
Leverage Trusted Tools: Use legitimate, non-intrusive tools to simulate RMM setup. This can incorporate actual IT management software in your testing to gauge realistic reaction times and decision-making processes.
Controlled Remote Access: Simulating remote tool installation can provide insights into procedural and user decision-making vulnerabilities during unexpected scenarios.

Good / Better / Best

Good: Craft messages with realistic social context—names and situations users encounter.
Better: Employ domains mimicking real-world IT processes, including active SSL certificates.
Best: Integrate real RMM software in controlled labs, documenting response fluffs and time-to-detection metrics.