RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)

Multiple Remote Monitoring and Management (RMM) tools are weaponized and distributed via phishing campaigns involving video files and email attachments. Threat actors exploit legitimate IT administration tools like ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able to gain remote access to compromised systems. The campaigns employ social engineering lures such as fake Adobe Acrobat updates and DocuSign viewers to convince victims to install these tools. The installation files include configuration data with deployment IDs, account identifiers, and command-and-control server addresses controlled by attackers. Delivery vectors include LNK, BAT, VBS files, and PDFs disguised as business documents, facilitating stealthy remote access and evasion of security detection.

Successful phishing leads to installation of legitimate RMM tools configured for attacker control, granting remote access to compromised systems. This enables threat actors to evade security detection by abusing trusted IT administration software. The embedded configuration data allows persistent command-and-control communication, potentially facilitating further malicious activities on affected systems.

No official patch or fix applies as this is an abuse of legitimate software rather than a software vulnerability. Mitigation focuses on user awareness to recognize phishing lures and avoid executing suspicious attachments or links. Organizations should monitor for unauthorized use of RMM tools and validate the legitimacy of remote access software installations. Employing email filtering and endpoint protection to detect phishing and malicious scripts can reduce risk.