Remote monitoring and management tools are essential to MSP operations, but their powerful capabilities can also attract attackers.
Microsoft Security Research recently detailed phishing campaigns that distributed legitimate MSP360 RMM software disguised as meeting invitations, software updates, document requests, and other familiar business content. Attackers then used that access to install ConnectWise ScreenConnect, creating another channel for remote access.
Importantly, Microsoft did not report exploitation of vulnerabilities in these products. Instead, attackers abused legitimate remote-management software—a distinction that offers several important lessons for MSPs.
1. Legitimate RMM Tools Can Be Abused
RMM platforms provide remote access, software deployment, command execution, and other capabilities MSPs depend on. Those same capabilities can be valuable to attackers.
In this campaign, users were tricked into downloading legitimate, digitally signed RMM software disguised as familiar workplace applications and requests.
MSP Action: Maintain a clearly defined list of approved remote-management applications across client environments and investigate unexpected RMM installations.
2. Watch for Multiple Remote-Access Tools
After gaining access through MSP360, attackers used it to download and install ScreenConnect, providing another remote administration channel.
For MSPs, the presence of multiple remote-management tools—especially when one unexpectedly installs another—can be an important warning sign.
MSP Action: Establish a baseline of approved RMM tools for each client and monitor for new or unauthorized remote-access applications.
3. Make RMM Governance Part of Security
Securing an MSP’s primary RMM platform isn’t enough. Providers also need policies governing which remote-management applications can operate within client environments.
Microsoft recommends governing approved RMM systems, using multifactor authentication where possible, and implementing application controls to restrict unauthorized management tools.
MSP Action: Document approved RMM applications, who can deploy them, required security controls, and procedures for investigating unauthorized installations.
4. Expand Phishing Education Beyond Passwords
Phishing doesn’t always lead to a fake login page. In this campaign, attackers used lures involving Zoom and Google Meet, Adobe and PDF readers, document signing, job offers, package deliveries, and other everyday activities to convince users to install software.
That means users can unintentionally provide attackers with remote access without ever surrendering a password.
MSP Action: Teach clients to be cautious when unexpected emails or websites ask them to install software, even when the application appears legitimate or familiar.
5. Monitor How RMM Tools Behave
Knowing whether software is legitimate is only part of the security equation. MSPs also need visibility into what remote-management applications are doing.
Unexpected installations, unusual processes, or an RMM agent deploying another remote-access application may indicate activity that deserves investigation.
MSP Action: Monitor for unusual RMM activity and incorporate unauthorized remote-management software into threat-hunting and incident-response procedures.
RMM Security Requires More Than Trusting the Tool
The Microsoft findings reinforce an important distinction for MSPs: trusted software doesn’t always mean trusted activity.
As attackers look for ways to operate through legitimate administrative technology, MSPs can strengthen client defenses by controlling which RMM applications are permitted, monitoring how they’re used, educating users about software-based phishing tactics, and responding quickly when remote-management activity falls outside the norm.
For MSPs, RMM security is increasingly about protecting not only the tools they use themselves, but the entire remote-management environment surrounding their clients.