- › Three separate campaigns disclosed on the same day all ended with the attacker installing legitimate remote monitoring and management software.
- › RMM tools are signed by their vendor, commonly allowlisted, and produce network traffic that looks exactly like the IT department doing its job.
- › CISA added the N-able N-central authentication bypass to its Known Exploited Vulnerabilities catalog after attackers used it to reach managed customer endpoints.
- › Detection built around malicious binaries does not fire on a tool your own help desk uses, so the control that works is an inventory and a deny-by-default rule.
- › Most organizations cannot answer which remote access tools are approved in their environment, which means they cannot alert on the ones that are not.
Look at three separate disclosures from a single day.
A multi-wave campaign using fake Adobe and Zoom update prompts, delivering ScreenConnect. A cluster tracked as Smoke#Screen, rotating social engineering pretexts and payloads, delivering ScreenConnect. And CISA adding the N-able N-central authentication bypass to its Known Exploited Vulnerabilities catalog after attackers used it to reach managed endpoints, where Sophos observed them deploying their own remote management tooling.
Different actors, different entry points, same ending. Nobody wrote malware. They installed the same category of product your IT team already runs.
Why This Category and Not Another
Put yourself on the other side and price out the options.
Writing a custom remote access trojan means building it, testing it against current detection, watching it get caught, and rebuilding. Every burn costs development time. Your payload is a signature the moment somebody submits it, and the whole industry gets an update within days.
Now price the alternative. ScreenConnect is a commercial product. It is code-signed by a real vendor with a real certificate. Thousands of legitimate businesses run it, so blocking it outright breaks somebody’s help desk. It phones home to vendor infrastructure, which means the network traffic goes to a domain with a clean reputation and years of history. It gives full interactive control, file transfer, and command execution out of the box, professionally maintained, with a support team fixing bugs.
The adversary’s development cost drops to zero and the detection cost drops with it. You cannot burn a signature that belongs to a legitimate product.
The Contractor Nobody Questions
Think about how a facility actually gets walked into.
Not through a window. Somebody arrives in a marked van, in a uniform, with a clipboard and a work order, and says they are here about the HVAC. Every person who sees them registers a contractor doing contractor things. The van is real. The uniform is real. The tools in the back are the same tools a real technician carries. What is false is the authorization, and authorization is the one thing nobody in the hallway can see.
Remote management software is the van. Your endpoint detection watches the parking lot for someone climbing the fence. The intruder drives up to the loading dock, and everything the sensor is calibrated to notice reads normal.
The physical version of this problem got solved decades ago, and not with better cameras. It got solved with a visitor log, a badge, and a person at a desk who checks whether the work order exists. That control is administrative, boring, and it works because it verifies authorization rather than appearance.
What This Costs When It Lands
The N-able case shows the blast radius, and it is the part that should get a budget conversation moving.
A remote monitoring and management (RMM) server is not one machine. It is the administrative control plane for every endpoint it manages. For a managed service provider (MSP) that means every client. Attackers who reached those servers did not get one foothold, they got the list, the agent, and the deployment mechanism, which is the same position your own administrators occupy. That is why CISA gave federal agencies three days rather than the usual timeline.
Run the arithmetic on your own environment. If someone owned your RMM console tonight, count the endpoints it can reach, then count the ones where it can execute code as SYSTEM. For most mid-sized organizations that is the entire estate. There is no lateral movement phase in this attack, because the tool was purpose-built to skip it. We made a related point about inherited vendor access in software you never installed.
What Actually Works
None of the controls below are exotic, and none of them involve buying a new product. They are all versions of the visitor log.
Inventory the remote access tools you approve
Write down every remote access product sanctioned in your environment. ScreenConnect, TeamViewer, AnyDesk, Splashtop, the RMM agent your MSP uses, whatever the answer is. Most organizations cannot produce this list, and until you can, you have nothing to compare against.
Alert on every tool that is not on the list
Once the approved list exists, everything else becomes a detection. A named alert on the installation or execution of an unapproved remote access tool is cheap, low false positive, and catches this entire family regardless of which lure got someone to click. This is the single highest-value control in the article.
Deny by default at the network layer
Block the vendor infrastructure for products you do not use. If your organization has never run AnyDesk, its cloud endpoints have no business resolving from your network. This turns a successful install into a failed session.
Treat your RMM console as a tier zero asset
The console deserves the same protection as your domain controllers: phishing-resistant multi-factor authentication, no shared administrator accounts, restricted network exposure, and its own alerting. Most organizations classify it as an IT tool rather than a crown jewel, and its capability says otherwise.
Ask your MSP the uncomfortable question
If a provider manages your endpoints, their RMM server is inside your threat model whether or not it appears in your risk register. Ask what version they run, how fast they patched N-central, and what they would tell you if their console were compromised. A provider who cannot answer quickly has given you the answer.
The Part Worth Repeating
Detection built to recognize malicious software does not fire on software that is not malicious. The attacker did not defeat your control. They stepped around the question it was designed to ask.
Go find out what your approved list says. If there is no list, that is the finding.
Want a clear picture of where your organization’s people and processes are exposed? Take our free Human Attack Surface Score assessment, or contact us for a full risk assessment.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
