Remote monitoring and management (RMM) tools

Remote monitoring and management software lets an IT team or managed service provider (MSP) see, script and take control of many endpoints from one console. ScreenConnect, AnyDesk and similar products are legitimate tools. That is the problem: an attacker who gets into the console, or installs a second copy of the agent, gets remote control that looks like normal IT work.

CISA, NSA and MS-ISAC warned about this in advisory AA23-025A (January 2023). They described a 2022 campaign where phishing emails led victims to download legitimate ScreenConnect and AnyDesk software, which was then used in a refund scam. They also said that actors from criminals to state-sponsored groups use legitimate RMM software as a backdoor for persistence or command and control, and that portable versions of these tools can run with local user rights and no full install, which gets past common software controls.

What the advisory tells defenders to do

Audit which remote access tools are on your network and which are authorised. Review logs for RMM programs running as portable executables, and use security tooling that can spot RMM software loaded only in memory. Use application control to allowlist the approved RMM product and block both installation and execution of unapproved and portable versions. Require approved RMM tools to be used only from inside your network through approved remote access such as a VPN or VDI. Block inbound and outbound connections on common RMM ports and protocols at the perimeter. Keep phishing training going, because a link is still the usual first step.

Where the MSP fits

If an MSP manages your fleet, its RMM console is part of your attack surface even though you do not run it. A compromise there can reach every customer at once. The November 2026 ScreenConnect campaign against MSPs (see the news card) is this pattern: attackers in an MSP's instance used its own command feature to install rogue clients on customer devices.

CyberStack guidance (our own advice, not CISA's)

Ask your MSP in writing: which RMM product and agent ID is authorised on your devices; whether its console needs phishing-resistant MFA; who can run scripts or commands across all customers; how long command and session logs are kept and whether you can get them; and how fast it will tell you about a console compromise. Put the answers in the contract and your incident runbook.

Allowlist one RMM product and one tenant or relay where your tooling can tell them apart. A second, unknown ScreenConnect or AnyDesk agent on an endpoint is an incident until proven otherwise.

When the MSP is breached, your own obligations still apply. Assess the Notifiable Data Breaches clock and, if you are a SOCI entity, your reporting clock, from the time you become aware.