TL;DR<\/h2>\n\n- \ud83d\udd12 RMM abuse surged by 70 percent. 27 percent of all hands-on-keyboard intrusions occur via RMM tools (CrowdStrike 2024).<\/li>\n
- \u26a0\ufe0f Kaseya VSA 2021: A zero-day vulnerability compromised 60 MSPs, affecting up to 1,500 companies, with a ransom demand of 70 million Euro.<\/li>\n
- \ud83d\udee1\ufe0f ConnectWise ScreenConnect CVE-2024-1709: CVSS 10.0, authentication bypass, trivially exploitable.<\/li>\n
- \ud83d\udcca 59.4 percent of all ransomware incidents stem from external remote access\/RMM tools (Arctic Wolf 2025).<\/li>\n
- \ud83d\udd27 CISA (Cybersecurity and Infrastructure Security Agency) and NSA (National Security Agency) recommend: Enforce MFA, network segmentation, allowlisting, and log all RMM sessions.<\/li>\n<\/ul>\n
Why Attackers Love RMM Tools<\/h2>\n
RMM software is built for legitimate IT operations: deploying updates, monitoring systems, and resolving issues remotely. As a result, the RMM agent has admin rights on every managed endpoint by design, network access to all clients, and the ability to execute code. For an attacker, this is the perfect backdoor – already installed.<\/p>\n
The second advantage: Legitimate software is far less likely to be flagged as malicious by security tools. When AnyDesk or ConnectWise ScreenConnect runs on a system, no EDR (Endpoint Detection and Response) raises an alarm. This is called \u201cliving off the land.\u201d In January 2023, CISA, NSA, and MS-ISAC (Multi-State Information Sharing and Analysis Center) issued a joint advisory describing how attackers deliberately use RMM software for persistence and command-and-control without installing malware.<\/p>\n
Sophos confirms: AnyDesk and PsExec appeared in more incidents than Cobalt Strike. At least 17 ransomware groups have been observed using AnyDesk, including REvil, Black Basta, and LockBit.<\/p>\n
\n\n+70 %<\/div>\nRMM abuse (CrowdStrike)<\/div>\n<\/div>\n\n27 %<\/div>\nof all intrusions via RMM<\/div>\n<\/div>\n\n59,4 %<\/div>\nransomware via remote access<\/div>\n<\/div>\n<\/div>\nSources: CrowdStrike Threat Hunting Report 2024, Arctic Wolf 2025<\/p>\n
Three Incidents That Illustrate the Risk<\/h2>\n
Kaseya VSA (July 2021).<\/strong> The REvil group exploited a zero-day vulnerability in Kaseya VSA, a widely used RMM platform for managed service providers (MSPs). Since VSA runs directly on the endpoints of all MSP customers, the attack had an immediate supply-chain impact: fewer than 60 MSPs were directly affected, but up to 1,500 downstream companies were compromised. The Swedish supermarket chain Coop had to close all 800 stores for nearly a week. REvil demanded 70 million Euro for a universal decryptor.<\/p>\nConnectWise ScreenConnect (February 2024).<\/strong> CVE-2024-1709 received the maximum CVSS score of 10.0. The vulnerability was an authentication bypass: a simple HTTP request to the setup page allowed attackers to overwrite all existing admin accounts and gain remote code execution. Proof-of-concept and Metasploit modules were available immediately. All versions below 23.9.8 were affected.<\/p>\nSimpleHelp (2025).<\/strong> CISA is currently warning about ongoing exploitation of SimpleHelp vulnerabilities (CVE-2024-57727, path traversal) by ransomware actors. This shows: The risk isn\u2019t historical – it\u2019s acute.<\/p>\n\n“Attackers deliberately use RMM software for persistence and command-and-control without installing malware. Security tools are significantly less likely to detect legitimate software as malicious.”
\nCISA\/NSA\/MS-ISAC Joint Advisory AA23-025A, January 2023<\/cite>\n<\/p><\/blockquote>\nSecurity Checklist for RMM Tools<\/h2>\n
The following measures are based on the CISA Guide to Securing Remote Access Software<\/em> and the Joint Advisory AA23-025A<\/em>.<\/p>\n1. Enforce MFA on every RMM account.<\/strong> Not just for admin access, but for any account that can control RMM sessions – including customer-facing services. Passkeys\/FIDO2<\/a> where possible.<\/p>\n2. Network segmentation.<\/strong> Isolate RMM management interfaces behind a VPN or in a dedicated admin network. The RMM server must not be accessible from the internet. Implement a zero-trust architecture.<\/p>\n3. Allowlisting instead of blocklisting.<\/strong> Restrict RMM communication to known IP pairs. Only permit approved RMM programs on the network. Any unauthorized RMM tool is a potential attack vector.<\/p>\n4. Log and monitor all RMM sessions.<\/strong> Immediately flag unusual connection times, connections from unknown IP addresses, and unusual session durations. Huntress frequently finds \u201cforgotten\u201d RMM instances in customer networks.<\/p>\n5. Maintain and reduce RMM inventory.<\/strong> Inventory all installed RMM tools. Uninstall unused tools immediately. Huntress reports a 214 percent increase in RMM-related incidents since January 2024. Every unnecessary tool is an attack surface.<\/p>\n6. Vendor security assessment.<\/strong> Regularly evaluate RMM providers: patch frequency, incident response processes, and security certifications. After ConnectWise (CVSS 10.0) and SimpleHelp, supplier assessments are no longer optional.<\/p>\n\nCVSS 10.0<\/div>\nConnectWise ScreenConnect CVE-2024-1709: maximum severity, trivially exploitable<\/div>\nSource: NVD, Unit 42, Huntress<\/div>\n<\/div>\nConclusion: The Biggest Risk Is the Tool Already Running<\/h2>\n
RMM tools aren\u2019t an optional risk. They\u2019re already running on endpoints. They already have admin rights. They\u2019re already in the network. The question isn\u2019t whether<\/em> to secure RMM, but how quickly<\/em>. CrowdStrike shows: More than a quarter of all hands-on attacks already use RMM tools as an entry point. Arctic Wolf documents: 59.4 percent of all ransomware incidents originate from external remote access. The CISA checklist above is the starting point. Today.<\/p>\nFrequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n\nWhich RMM tools have been abused in attacks?<\/strong><\/summary>\nDocumented cases include: ConnectWise ScreenConnect, Kaseya VSA, AnyDesk, TeamViewer, SimpleHelp, NinjaOne, and Datto RMM. At least 17 ransomware groups deliberately use AnyDesk. ConnectWise had a vulnerability with a CVSS score of 10.0 in 2024.<\/p>\n<\/details>\n\nHow can I detect RMM abuse in my network?<\/strong><\/summary>\nInventory all installed RMM tools (including unauthorized ones). Monitor RMM sessions for unusual times, source IPs, and durations. Set up EDR rules to flag RMM processes starting outside business hours. CISA explicitly recommends allowlisting for RMM communication.<\/p>\n<\/details>\n\nShould we eliminate RMM tools?<\/strong><\/summary>\nNo. RMM is indispensable for IT operations. But it must be hardened: MFA, network segmentation, logging, and vendor assessments. An unsecured RMM tool is more dangerous than no RMM tool at all.<\/p>\n<\/details>\n\nHow does the Kaseya incident differ from a typical ransomware attack?<\/strong><\/summary>\nThe supply-chain multiplier. Kaseya VSA runs as an agent on the endpoints of all MSP customers. A single compromised server didn\u2019t affect one customer – it impacted up to 1,500 downstream companies simultaneously. This is the structural risk of any centralized management platform.<\/p>\n<\/details>\n
\nRecommended Reading<\/h2>\n\n- Identity Security Gap: What Zero Trust Doesn\u2019t Protect<\/a><\/li>\n
- Cloud Misconfigurations: The 10 Most Dangerous Security Flaws<\/a><\/li>\n
- Agentic AI Security: When AI Agents Become Attack Targets<\/a><\/li>\n<\/ul>\n<\/div>\n\n<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/identity-security-gap-cybersecurity-250x167.jpeg\")
<\/span>Editor’s Pick<\/span>Identity Security Gap: What Zero Trust Misses and How to Close It<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/cloud-fehlkonfigurationen-server-rack-250x166.jpeg\")
<\/span>Editor’s Pick<\/span>Cloud Misconfigurations: Top 10 Security Gaps in AWS and Azure<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/agentic-ai-security-robot-250x167.jpeg\")
<\/span>Editor’s Pick<\/span>Agentic AI Security: When AI Agents Become the Attack Target<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-cybersecurity-boom-nis2-deutschlands-sic-39412011-250x166.jpg\")
<\/span>MyBusinessFuture<\/span>Cybersecurity Boom: NIS2 Drives Germany\u2019s Security Growth<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-ciso-compliance-under-nis2-67286561-250x143.jpg\")
<\/span>Digital Chiefs<\/span>Managed Security Services: CISO Does Not Bear Sole Liability<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-container-supply-chain-security-wie-it-t-655299.jpg\")
<\/span>cloudmagazin<\/span>Container Supply Chain Security: IT Teams Secure Software Chains<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"RMM tools (Remote Monitoring and Management) have privileged access to all managed endpoints by design. This very feature makes them the preferred gateway for attackers. CrowdStrike\u2019s 2024 Threat Hunting Report documents that RMM abuse grew by 70 percent year-over-year, accounting for 27 percent of all hands-on-keyboard intrusions. A compromised RMM server […]","protected":false},"author":50,"featured_media":5489,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"rmm tools","_yoast_wpseo_title":"RMM Tools as a Gateway: Security Checklist for ConnectWise, Kaseya, and Others","_yoast_wpseo_metadesc":"RMM tools security: Protect your endpoints from attacks via ConnectWise, Kaseya & more. Get the essential checklist now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5459"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-7649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":7,"wpml_language":"en","wpml_translation_of":5459,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7649"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649\/revisions"}],"predecessor-version":[{"id":21723,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649\/revisions\/21723"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5489"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Why Attackers Love RMM Tools<\/h2>\n
RMM software is built for legitimate IT operations: deploying updates, monitoring systems, and resolving issues remotely. As a result, the RMM agent has admin rights on every managed endpoint by design, network access to all clients, and the ability to execute code. For an attacker, this is the perfect backdoor – already installed.<\/p>\n
The second advantage: Legitimate software is far less likely to be flagged as malicious by security tools. When AnyDesk or ConnectWise ScreenConnect runs on a system, no EDR (Endpoint Detection and Response) raises an alarm. This is called \u201cliving off the land.\u201d In January 2023, CISA, NSA, and MS-ISAC (Multi-State Information Sharing and Analysis Center) issued a joint advisory describing how attackers deliberately use RMM software for persistence and command-and-control without installing malware.<\/p>\n
Sophos confirms: AnyDesk and PsExec appeared in more incidents than Cobalt Strike. At least 17 ransomware groups have been observed using AnyDesk, including REvil, Black Basta, and LockBit.<\/p>\n
Sources: CrowdStrike Threat Hunting Report 2024, Arctic Wolf 2025<\/p>\n
Three Incidents That Illustrate the Risk<\/h2>\n
Kaseya VSA (July 2021).<\/strong> The REvil group exploited a zero-day vulnerability in Kaseya VSA, a widely used RMM platform for managed service providers (MSPs). Since VSA runs directly on the endpoints of all MSP customers, the attack had an immediate supply-chain impact: fewer than 60 MSPs were directly affected, but up to 1,500 downstream companies were compromised. The Swedish supermarket chain Coop had to close all 800 stores for nearly a week. REvil demanded 70 million Euro for a universal decryptor.<\/p>\n ConnectWise ScreenConnect (February 2024).<\/strong> CVE-2024-1709 received the maximum CVSS score of 10.0. The vulnerability was an authentication bypass: a simple HTTP request to the setup page allowed attackers to overwrite all existing admin accounts and gain remote code execution. Proof-of-concept and Metasploit modules were available immediately. All versions below 23.9.8 were affected.<\/p>\n SimpleHelp (2025).<\/strong> CISA is currently warning about ongoing exploitation of SimpleHelp vulnerabilities (CVE-2024-57727, path traversal) by ransomware actors. This shows: The risk isn\u2019t historical – it\u2019s acute.<\/p>\n \n“Attackers deliberately use RMM software for persistence and command-and-control without installing malware. Security tools are significantly less likely to detect legitimate software as malicious.” The following measures are based on the CISA Guide to Securing Remote Access Software<\/em> and the Joint Advisory AA23-025A<\/em>.<\/p>\n 1. Enforce MFA on every RMM account.<\/strong> Not just for admin access, but for any account that can control RMM sessions – including customer-facing services. Passkeys\/FIDO2<\/a> where possible.<\/p>\n 2. Network segmentation.<\/strong> Isolate RMM management interfaces behind a VPN or in a dedicated admin network. The RMM server must not be accessible from the internet. Implement a zero-trust architecture.<\/p>\n 3. Allowlisting instead of blocklisting.<\/strong> Restrict RMM communication to known IP pairs. Only permit approved RMM programs on the network. Any unauthorized RMM tool is a potential attack vector.<\/p>\n 4. Log and monitor all RMM sessions.<\/strong> Immediately flag unusual connection times, connections from unknown IP addresses, and unusual session durations. Huntress frequently finds \u201cforgotten\u201d RMM instances in customer networks.<\/p>\n 5. Maintain and reduce RMM inventory.<\/strong> Inventory all installed RMM tools. Uninstall unused tools immediately. Huntress reports a 214 percent increase in RMM-related incidents since January 2024. Every unnecessary tool is an attack surface.<\/p>\n 6. Vendor security assessment.<\/strong> Regularly evaluate RMM providers: patch frequency, incident response processes, and security certifications. After ConnectWise (CVSS 10.0) and SimpleHelp, supplier assessments are no longer optional.<\/p>\n RMM tools aren\u2019t an optional risk. They\u2019re already running on endpoints. They already have admin rights. They\u2019re already in the network. The question isn\u2019t whether<\/em> to secure RMM, but how quickly<\/em>. CrowdStrike shows: More than a quarter of all hands-on attacks already use RMM tools as an entry point. Arctic Wolf documents: 59.4 percent of all ransomware incidents originate from external remote access. The CISA checklist above is the starting point. Today.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Documented cases include: ConnectWise ScreenConnect, Kaseya VSA, AnyDesk, TeamViewer, SimpleHelp, NinjaOne, and Datto RMM. At least 17 ransomware groups deliberately use AnyDesk. ConnectWise had a vulnerability with a CVSS score of 10.0 in 2024.<\/p>\n<\/details>\n Inventory all installed RMM tools (including unauthorized ones). Monitor RMM sessions for unusual times, source IPs, and durations. Set up EDR rules to flag RMM processes starting outside business hours. CISA explicitly recommends allowlisting for RMM communication.<\/p>\n<\/details>\n No. RMM is indispensable for IT operations. But it must be hardened: MFA, network segmentation, logging, and vendor assessments. An unsecured RMM tool is more dangerous than no RMM tool at all.<\/p>\n<\/details>\n The supply-chain multiplier. Kaseya VSA runs as an agent on the endpoints of all MSP customers. A single compromised server didn\u2019t affect one customer – it impacted up to 1,500 downstream companies simultaneously. This is the structural risk of any centralized management platform.<\/p>\n<\/details>\n
\nCISA\/NSA\/MS-ISAC Joint Advisory AA23-025A, January 2023<\/cite>\n<\/p><\/blockquote>\nSecurity Checklist for RMM Tools<\/h2>\n
Conclusion: The Biggest Risk Is the Tool Already Running<\/h2>\n
Frequently Asked Questions<\/h2>\n
Which RMM tools have been abused in attacks?<\/strong><\/summary>\n
How can I detect RMM abuse in my network?<\/strong><\/summary>\n
Should we eliminate RMM tools?<\/strong><\/summary>\n
How does the Kaseya incident differ from a typical ransomware attack?<\/strong><\/summary>\n
Recommended Reading<\/h2>\n
\n
Editor’s Picks<\/h3>\n
<\/span>Editor’s Pick<\/span>Identity Security Gap: What Zero Trust Misses and How to Close It<\/span><\/span><\/a><\/span>Editor’s Pick<\/span>Cloud Misconfigurations: Top 10 Security Gaps in AWS and Azure<\/span><\/span><\/a><\/span>Editor’s Pick<\/span>Agentic AI Security: When AI Agents Become the Attack Target<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
<\/span>MyBusinessFuture<\/span>Cybersecurity Boom: NIS2 Drives Germany\u2019s Security Growth<\/span><\/span><\/a><\/span>Digital Chiefs<\/span>Managed Security Services: CISO Does Not Bear Sole Liability<\/span><\/span><\/a><\/span>cloudmagazin<\/span>Container Supply Chain Security: IT Teams Secure Software Chains<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"RMM tools (Remote Monitoring and Management) have privileged access to all managed endpoints by design. This very feature makes them the preferred gateway for attackers. CrowdStrike\u2019s 2024 Threat Hunting Report documents that RMM abuse grew by 70 percent year-over-year, accounting for 27 percent of all hands-on-keyboard intrusions. A compromised RMM server […]","protected":false},"author":50,"featured_media":5489,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"rmm tools","_yoast_wpseo_title":"RMM Tools as a Gateway: Security Checklist for ConnectWise, Kaseya, and Others","_yoast_wpseo_metadesc":"RMM tools security: Protect your endpoints from attacks via ConnectWise, Kaseya & more. Get the essential checklist now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5459"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-7649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":7,"wpml_language":"en","wpml_translation_of":5459,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7649"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649\/revisions"}],"predecessor-version":[{"id":21723,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7649\/revisions\/21723"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5489"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}