Threat Actors Weaponize Legitimate System Management Tools in Nearly Half of Incidents

Security researchers found that attackers exploited legitimate remote monitoring and management software in 45 percent of endpoint incidents during the first quarter of 2026, representing a 277 percent year-over-year increase from 2025. Once installed through phishing or deception, RMM tools grant persistent access that blends seamlessly with normal administrative activity, and attackers often layer additional remote access utilities to create multiple backdoors. Organizations should maintain an inventory of approved RMM solutions and establish detection methods for unauthorized tools on their networks.

Attackers have discovered that deploying commercially available administrative software provides a nearly invisible entry point into corporate networks. Because legitimate IT departments routinely use these same tools for standard operations, malicious installations blend seamlessly into normal system activity, allowing intruders to maintain long-term access without triggering immediate suspicion. The dramatic increase in this technique reflects how adversaries increasingly favor established software over custom-built malware.

The sophistication of delivery mechanisms has also evolved. Rather than relying solely on traditional phishing, attackers now craft convincing fake service agreements and vendor communications to trick users into installing compromised versions of these tools. Once established, attackers frequently layer multiple remote access utilities on a single device, creating redundant backdoors that ensure persistent access even if one avenue of compromise is discovered and removed.