Rmm Tools is a tool tracked across 11 threat clusters and 10 intelligence report mentions on ThreatCluster. First observed November 4, 2025; most recent activity July 21, 2026.
RMM tools (remote monitoring and management software) are legitimate remote-access platforms used by IT professionals and managed service providers. Attackers abuse these tools to gain covert access, move laterally, and deploy malware, making RMM infrastructure a high-risk attack surface. Recent reports show threat actors leveraging RMM tools to deploy ransomware (Medusa and DragonForce), target academics and foreign policy experts, and hijack trucking operations.
Cyber attackers are increasingly using Microsoft Teams to impersonate IT helpdesk staff, employing social engineering tactics to gain remote access to enterprise systems. This method, known as 'cross-tenant helpdesk…
Microsoft's Defender Security Research Team reported phishing campaigns utilizing signed malware disguised as workplace applications. This malware, backed by a stolen EV certificate, installs remote monitoring and…
A cybercrime operation named The Quarry has been identified as the source of numerous phishing campaigns targeting American taxpayers. These campaigns impersonate the IRS and SSA, exploiting a Phishing-as-a-Service…
In 2025, ransomware groups Medusa and DragonForce targeted UK organizations by exploiting three critical vulnerabilities in the SimpleHelp Remote Monitoring and Management platform. These vulnerabilities…
In June 2026, a series of ransomware attacks were reported in Colombia and Mexico, where attackers exploited misconfigured corporate printers and remote desktop services to encrypt data using BitLocker. The attackers…
In 2025, ransomware groups Medusa and DragonForce targeted UK organizations by exploiting vulnerabilities in the SimpleHelp Remote Monitoring and Management platform. They leveraged three critical vulnerabilities…
Cybercriminals are exploiting Remote Monitoring and Management (RMM) software to target trucking firms, leading to significant cargo thefts. These attacks, which have been linked to organized crime, primarily affect…
Iranian hackers are utilizing Remote Monitoring and Management (RMM) tools to target academics and foreign policy experts. The attacks focus on exploiting vulnerabilities in these tools to gain unauthorized access to…
Cybercriminals are exploiting remote monitoring and management (RMM) tools through weaponized PDF files to gain unauthorized access to victim machines. These attacks leverage the trusted nature of RMM software, such as…
Iranian hackers are exploiting Remote Monitoring and Management (RMM) tools to target academics and foreign policy experts. The attacks aim to gather sensitive information and disrupt operations within these sectors.…