RMM Abuse Surge — Red Canary's Detection Guide for 8 Remote Monitoring Tools Abused by Threat Actors

Red Canary documents accelerating abuse of legitimate remote monitoring and management tools, naming ScreenConnect, NetSupport Manager, SimpleHelp, PDQ Connect, iDrive RemotePC, Syncro, Atera, ITarian, and QuickAssist, by ransomware groups and financially motivated attackers. The recurring patterns: adversaries use one free-trial RMM to deploy a second, more permanent RMM; multiple RMMs on a single host are common, with four concurrent tools observed; and attackers use cracked license keys, renamed binaries in non-standard paths, and MSIExec side-loading to evade EDR.

The threadlinqs analysis added to this story narrows the picture to initial access brokers, which weaponize signed RMM tools from ConnectWise, GoTo, and Datto as the initial foothold and then hand the access to a second RAT. That report publishes 9 detections and 23 IOCs tied to the tradecraft.

The detection shift is the takeaway: stop asking whether an RMM binary is malicious and start asking whether the RMM behavior is authorized. Signing and vendor reputation carry no weight when the tool is genuine and the operator is not. Watch for remote access tools appearing on servers that have no administrative reason to run them, an RMM install followed within hours by a second one, and free-trial tenants being used from infrastructure that does not match the organization. Tune EDR to alert on RMM behavior rather than file reputation.