Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

RMM tool abuse: how attackers use remote management software and how to protect your business

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 12 November 2026.

In one sentence: Remote monitoring and management (RMM) software lets an IT provider see, update and control every computer you own from one console, so an attacker who gets into that console, or who installs a copy of the same tool, can control all of them too.

What it is

RMM software is an agent installed on each laptop and server, plus a central console. CISA describes it as software that lets managed service providers (MSPs), SaaS providers and IT help desks “remotely perform several functions, including gathering data on network and device health, automating maintenance, PC setup and configuration, remote recovery and backup, and patch management”. In plain terms: it can run scripts, push software and take over a screen.

“RMM abuse” covers two different problems. In the first, attackers take over the console your provider uses. In the second, attackers install a legitimate RMM tool on a victim’s machine and use it as a backdoor. Both work because the tool is trusted and does what an administrator would do.

How it works

  1. The attacker gets a foothold. CISA lists several routes: phishing that leads a victim to download RMM software, exploiting a vulnerable RMM server, using stolen RMM credentials, or going through a third-party relationship such as an MSP.
  2. They use the tool as their own. The CISA, NSA and MS-ISAC advisory says “malicious cyber actors, from cybercriminals to nation-state sponsored groups, are known to use legitimate RMM software as a backdoor for persistence and command and control”. The tool is normal software, so security products often stay quiet.
  3. They avoid needing admin rights. The same advisory notes that actors used
  4. They scale up. The CISA guide says that if attackers first compromise an MSP, “they could gain access to a large number of the affected MSP’s customers’ networks and data.”

What they are after depends on the attacker: money from a refund scam, ransomware across many endpoints, or quiet long-term access.

Attackergets in RMM console(IT provider) Your laptops Your servers Other customers One door, many rooms: scripts and remote control reach every enrolled device

Who it affects and how badly

CISA’s guide says “small and mid-sized businesses rely on MSPs and remote access software to supplement their own IT, and scale network environments without having to develop those capabilities internally”. That makes SMEs the downstream victims of a provider compromise, in the UK, EU, US and Armenia alike.

  • Sole trader to 10 staff: you will not run RMM yourself, but your provider probably does. Worst case: your devices are used to deploy ransomware, you cannot work for days and client data is exposed.
  • 10 to 50 and 50 to 250 staff: often RMM is run in-house or by an MSP. Worst case: scripts pushed to every machine at once, downtime across the whole business, and a notifiable personal data breach if client data is taken.
  • Regulated and 250 plus (fintech, insurance, healthcare, local councils): the provider is a supplier you must be able to show you controlled. Worst case: regulatory attention for weak supplier oversight, plus lost clients.

Accountancy and legal practices, care providers, schools and recruitment firms are common MSP customers, so they are exposed to a provider problem they cannot see.

Real examples

  • N-able N-central, November 2026. An independent researcher published details and proof-of-concept code for more than 30 flaws in N-central, an RMM platform. N-able “took its hosted N-central environment offline and urged on-premises customers to shut down their servers”. On 10 November it “released N-central 2026.4 HF2”. N-able said it saw “scanning activity associated with the published proof-of-concept code but no evidence that any customer environment had been successfully exploited”. Huntress notes that “all customers, both hosted and on-premises, must also upgrade their Agents and Probes”. Sources: The Hacker News, Huntress.
  • Help desk refund scam, 2022 to 2023. CISA, NSA and MS-ISAC reported “help desk-themed phishing emails that led victims to download ScreenConnect and AnyDesk, used to steal money from bank accounts”. Source: CISA AA23-025A.

The UK angle

The NCSC’s guide for small and medium-sized organisations, *Choosing a managed service provider*, says to “use least privilege” (giving your MSP only the permissions needed to do the job) and to “enforce 2SV”. It also asks you to check “how they manage access into your systems and how those connections are secured”. It recommends patching “within 14 days of an update being released where the patch fixes a critical or high-risk vulnerability”, and says to “use MSPs with recognised certifications such as Cyber Essentials Plus”. The same guide says to check “if logs are being kept for security purposes, how long, and whether you can access them”.

What we check on a test

This is the method a Wolfcore penetration tester follows when RMM is in scope. It describes what we look at, not findings.

  • Whether the RMM console, agent ports or support portals are reachable from the internet, and which version they report.
  • How the console authenticates: MFA, default or shared admin accounts, and password reuse across customers.
  • What each agent can do on a device, and whether a low-privilege “read-only” mode exists and is used.
  • Whether scripts can be pushed to many devices at once without a second approval.
  • Whether a compromised endpoint can reach the console’s internal management interfaces, or other customers’ networks.
  • Whether the RMM service account sits in a privileged directory group, and whether logs of RMM actions are kept somewhere the tool cannot delete.

How to detect it

  1. Build an inventory of every remote access tool allowed on your network, then alert on any other. CISA advises you to “audit remote access tools on your network to identify currently used and authorised RMM software”.
  2. Review logs for RMM programs running as portable executables from user folders such as Downloads or Temp.
  3. In Microsoft 365 or Google Workspace, review admin and sign-in logs for new admin accounts, new app consents and sign-ins from unfamiliar countries on provider accounts.
  4. Ask your provider for the RMM audit log: new administrators, new scripts, new remote sessions. Huntress advises watching for “anomalous remote access sessions, new scripts being deployed, or the unauthorised creation of new administrator accounts”.
  5. Watch outbound connections to remote-support domains you do not use.

How to fix or prevent it

  1. Put RMM consoles behind a VPN or allow-list, not on the open internet. CISA advises that authorised RMM only be used “from within your network over approved remote access solutions such as VPNs or virtual desktop interfaces”.
  2. Patch RMM servers, agents and probes first. They are internet-facing or high-privilege, so treat vendor emergency notices as urgent.
  3. Turn on MFA for every RMM and provider account, and never reuse admin credentials across customers.
  4. Use least privilege: give the RMM and your provider the narrowest role that does the job (see least-privilege).
  5. Use application allow-listing so only your approved RMM runs, including portable copies.
  6. Require approval for mass scripting. CISA suggests re-triggering MFA if an account pushes commands to 10 or more devices in an hour.
  7. Segment the network so one compromised device cannot reach the rest.
  8. Write the above into the provider contract: incident notification times, log access and who is responsible for patching.

Related terms

supply-chain-attack, zero-day, ransomware, patch-management, how-privilege-escalation-works, least-privilege

Browse the Cloud and infrastructure category.

FAQ

Is RMM software itself dangerous? No. It is legitimate and widely used. The risk is that the console and agents are powerful, so they need strong access control and fast patching.

Does antivirus stop RMM abuse? Not reliably. CISA says RMM software “generally does not trigger antivirus or antimalware defences because it is legitimate software”.

What should I ask my IT provider this week? Which RMM they use, whether it is patched, whether MFA protects it, and how they would tell you if it were compromised.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at free web vulnerability scan and see our penetration testing service.