Key points
- Huntress data indicates remote monitoring and management abuse rose roughly 277 percent year over year in 2026.
- Attackers use these trusted tools to blend into normal admin activity, evading traditional security assumptions.
- The trend reflects a broader shift where cybercrime becomes more sophisticated, coordinated and personal compared to previous years.
Attackers are no longer breaking down digital doors; they are using keys you handed them. By hijacking remote monitoring and management platforms, threat actors gain seamless access to networks while appearing as legitimate administrators. This tactic allows them to bypass traditional defences that assume approved tools are inherently safe, making detection significantly harder for security teams.
In plain English
Remote monitoring and management software helps IT teams maintain systems efficiently. However, when attackers compromise these platforms, they inherit the same high-level permissions. This means their malicious actions look like routine maintenance tasks. Traditional security systems often ignore this traffic because it comes from a sanctioned source, leaving a blind spot that criminals exploit to move laterally and establish persistence within the environment.
The background
According to Huntress, the threat landscape in 2026 is sharper and more brazen than in previous years. Challenges such as tight budgets and rising AI anxiety have matured into coordinated cybercrime efforts. The 277 percent jump in RMM abuse highlights a defining attack pattern of the year. This surge demonstrates that attackers are prioritising trusted infrastructure over complex exploits, leveraging existing access rather than seeking new entry points through traditional vulnerability scanning.
What changes now
Defenders must shift from asking if tools are set up correctly to preparing for inevitable misuse. Huntress suggests implementing managed endpoint detection and response to watch for unusual process chains and persistence mechanisms, even from sanctioned tools. Behavioural monitoring becomes critical, as static configurations are insufficient. Teams need to focus on catching abuse during the staging phase, before encryption or data exfiltration occurs, by correlating telemetry across endpoints and identities.
The attacker's path
Teams usually focus on perimeter defences, but this technique relies on internal trust. The weakness is the assumption that legitimate software cannot be weaponised. Attackers exploit this by using authorised credentials to execute commands that mimic standard administration. This serves the lateral movement and persistence stages of an intrusion, allowing them to operate below the radar of traditional alerts. Check whether your monitoring solutions distinguish between normal and anomalous behaviour within trusted applications, regardless of the source.
Background: Vulnerability scanning
Vulnerability scanning uses automated tools to identify known security weaknesses in your systems. It is a foundational hygiene task that detects misconfigurations and outdated software. It does not replace manual testing for complex logic flaws or business-specific risks.
Read the full guide: Vulnerability scanning explained: find flaws before attackers do
What to do and how to stay safe: Huntress
- Review access logs for remote management tools to identify unusual command sequences or off-hours activity that deviates from standard administrative patterns.
- Implement behavioural monitoring on endpoints to detect suspicious process chains, even when they originate from approved remote access software.
- Ensure security awareness training covers scenarios where trusted IT tools are compromised, helping staff recognise signs of account takeover.
- Validate that detection systems are configured to flag lateral movement attempts regardless of the application used to initiate the connection.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much has RMM abuse increased according to Huntress?
Huntress data shows that abuse of remote monitoring and management tools jumped roughly 277 percent year over year in 2026.
Why are traditional defenses failing against RMM abuse?
Traditional defenses often assume that activity from approved tools is safe, allowing attackers to blend seamlessly into normal admin activity.
What is the recommended approach to defending against this threat?
Defenders should shift to monitoring for behaviour, such as unusual process chains and persistence mechanisms, even when activity originates from sanctioned RMM tools.
