Plan
archived
Phishing Campaigns Abuse MSP360 RMM to Deploy ScreenConnect Backdoors
- Engineer — Plan: Audit your environment for unauthorized ScreenConnect or MSP360 installations; enforce an approved-software allowlist for remote management tools and review recent RMM deployments against your IT change log.
- SOC/IR — Plan: Build or tune detections for unexpected RMM binary executions (MSP360, ScreenConnect) outside your approved management estate; create a hunt query for remote-access tools installed in the past 30 days that don’t match IT provisioning records.
- Leader — Learn: Documents a growing pattern of threat actors weaponizing legitimate remote-management software to evade controls; useful context for a quarterly risk review of MSP or RMM-tool exposure, but no immediate leadership action is indicated by the available signals.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.