As cited
Copy frozen at (site build).
threat intel
More RMM Tools In the Wild
Threat actors are abusing legitimate remote management and monitoring (RMM) tools to deliver malware through phishing campaigns. The latest attack uses a fake PDF invoice that redirects to a malicious VBS script, which then downloads and installs Action1 RMM software via an MSI file with an expired certificate. The installed agent establishes persistence as a Windows service and connects to Action1 infrastructure, suggesting attackers exploit free or test accounts within the RMM provider's cloud environment.
Why it matters: Organizations using or allowing Action1 and other RMM tools need to monitor for suspicious installation patterns and restrict RMM deployment to trusted administrative channels, as threat actors are weaponizing legitimate RMM infrastructure to establish persistent remote access.
- Source published
- First seen by Cybersecurity Tracker