Remote monitoring and management (RMM) tools are software platforms that IT teams and managed service providers use to monitor, update and control many computers remotely – and that attackers increasingly abuse for covert access.
How RMM tools work
An RMM product installs a lightweight agent on each managed endpoint. The agent reports health and inventory data to a central console and lets administrators run scripts, deploy patches, transfer files and open remote desktop sessions. Well-known products include ConnectWise ScreenConnect, Kaseya VSA, N-able, NinjaOne, Atera, TeamViewer and AnyDesk. Because the agents run with high privileges and are trusted by design, a single console can control thousands of machines across many customers.
Why RMM tools matter for security
RMM software is a favourite of attackers in two ways:
- Abuse of legitimate tools – after gaining access, intruders install AnyDesk, ScreenConnect or similar programs as a quiet backdoor. These tools are signed and widely used, so antivirus rarely blocks them – a form of living off the land. A 2023 joint advisory by CISA, the NSA and MS-ISAC warned about criminals tricking users into installing RMM software as part of help-desk and tech support scams. MITRE ATT&CK tracks this as Remote Access Software (T1219).
- Attacks on RMM platforms – compromising a provider’s console turns it into a supply chain attack. In July 2021 the REvil gang exploited Kaseya VSA to push ransomware to roughly 1,500 businesses through their managed service providers. Critical ScreenConnect vulnerabilities disclosed in 2024 were exploited within days.
How to secure RMM tools
- Standardise on one approved RMM product and block or alert on all others with application control.
- Protect consoles with MFA, restrict them to trusted networks and patch them promptly.
- Monitor for new remote access agents and unusual sessions, just as you would for exposed RDP.
- Require managed service providers to follow least-privilege and logging requirements in contracts.
