Phishing Campaigns Abuse MSP360 RMM to Deploy ScreenConnect Backdoors

Wed, 30 Sep 2026 16:48:49 +0000

Engineer — Plan: Audit your environment for unauthorized ScreenConnect or MSP360 installations; enforce an approved-software allowlist for remote management tools and review recent RMM deployments against your IT change log.
SOC/IR — Plan: Build or tune detections for unexpected RMM binary executions (MSP360, ScreenConnect) outside your approved management estate; create a hunt query for remote-access tools installed in the past 30 days that don’t match IT provisioning records.
Leader — Learn: Documents a growing pattern of threat actors weaponizing legitimate remote-management software to evade controls; useful context for a quarterly risk review of MSP or RMM-tool exposure, but no immediate leadership action is indicated by the available signals.

Persistent-Access on CuraSec