What is Remote Management and Monitoring (RMM) in Phishing?

In the realm of phishing and social engineering, Remote Management and Monitoring (RMM) refers to software tools and systems used by threat actors to control target devices from a distance, monitor their activities, and facilitate unauthorized access. While designed for IT support and administration, in this context, RMM becomes a vector for unauthorized control.

Definition

Remote Management and Monitoring (RMM) in phishing is the use of legitimate software tools by threat actors to gain control over a victim’s system, allowing for unauthorized access, persistent presence, and data exfiltration.

Why It Matters

RMM tools are typically used in legitimate settings for IT administrators to manage and support systems without physically accessing them. However, in the hands of a threat actor, these tools become instruments for controlling compromised environments. This capability is critical in phishing campaigns for maintaining stealth, persistence, and facilitating lateral movement across networks.

An operator might encounter RMM during the post-exploitation phase of a phishing campaign. After initial access via a phishing email, the deployment of an RMM tool ensures continued access and control over the compromised system. Threat actors use RMM tools to deploy additional malware, monitor user activities, and gradually expand their foothold within the target network.

In Practice

When phishing campaigns are executed, RMM tools can appear in several forms. Here are examples of how they are leveraged:

A phishing email disguised as a URGENT IT Support request prompts the target to install a supposed IT support tool. This “tool” is a legitimate RMM software that the threat actor then uses to manage the victim system remotely.
A security alert email from a spoofed IT services provider containing a link that downloads a remote admin tool, allegedly to “secure” the user’s machine, infecting it instead.

In a real-world scenario, attackers might craft an email subject like “Immediate Security Update Required”. The email content convinces the user to install or run a file that is an RMM tool under the guise of necessary security software updates. Once installed, the attacker has access equivalent to the legitimate user, allowing for system manipulation, data access, and even deploying ransomware.

In another case, an actual phishing campaign might exploit brands like “TeamViewer” or “AnyDesk” — legitimate RMM solutions used under false pretenses. Phishing emails might masquerade as invitations or support messages requiring the installation and use of these applications for “urgent support”.


Subject: System Update Access Required

From: support@notarealms.com

Message:

Dear User,



As part of our regular security protocol, please install the attached remote access tool for this week's update.

Link: [malicious link resembling legitimate domain]



Thank you,

IT Support

Related Terms

If you’re examining RMM use in phishing, you should also familiarize yourself with Credential Harvesting, where attackers collect user credentials often as a prerequisite to implementing RMM. Another important term is Lateral Movement, a tactic where once inside a network, attackers move through the system to expand their access.