Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In July 2026, Microsoft Defender Experts observed sophisticated phishing campaigns targeting multiple industries that distributed legitimate MSP360 Remote Monitoring and Management (RMM) software under deceptive filenames. Threat actors used social engineering themes including meeting invitations, PDF updates, and software installation prompts to trick victims into executing the masqueraded installer. Once deployed, the MSP360 RMM established persistent access and was used to download and install ConnectWise ScreenConnect, creating redundant remote access channels for credential harvesting, information collection, and follow-on malicious activities.

This incident highlights the growing trend of threat actors abusing legitimate remote administration tools to blend into normal IT operations while maintaining persistent access. As organizations increasingly rely on remote management solutions, attackers are exploiting the inherent trust and broad privileges these tools possess to evade detection and establish durable footholds in enterprise environments.

Why This Matters Now

Remote management tool abuse is surging as attackers exploit the widespread adoption of legitimate RMM platforms, making detection increasingly difficult as malicious activity blends with normal IT operations.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Organizations should implement application control policies, monitor for unexpected service registrations, and use advanced hunting queries to identify suspicious RMM deployments and remote command execution patterns.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of this MSP360/ScreenConnect RMM attack by constraining lateral movement between network segments and limiting outbound communication paths. The segmented architecture could contain the compromise within specific workload boundaries rather than allowing enterprise-wide access.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial compromise may still occur through endpoint phishing, but CNSF could limit the attacker's ability to discover and reach additional cloud workloads or services beyond the initially compromised system through network-level visibility and control.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Local privilege escalation may still succeed on the compromised endpoint, but zero trust segmentation would likely limit the scope of administrative access to other network segments and reduce the attacker's ability to leverage elevated privileges across workload boundaries.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely constrain the attacker's ability to move laterally between network segments and limit ScreenConnect installation to authorized workloads, reducing the scope of secondary access channel deployment across the infrastructure.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility could likely detect and constrain suspicious outbound connections from compromised workloads, reducing the reliability of C2 channels and limiting the attacker's ability to maintain persistent command and control across distributed cloud environments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policies would likely constrain data exfiltration by limiting outbound data transfers and blocking unauthorized file transfers through ScreenConnect channels, reducing the volume and scope of sensitive information that could be extracted from compromised environments.

Impact (Mitigations)

The overall impact would likely be constrained to isolated network segments rather than enterprise-wide compromise, limiting the scope of affected systems and reducing the total volume of credentials and sensitive data accessible to the threat actors.

Impact at a Glance

Affected Business Functions

  • IT Operations and Remote Management
  • Information Security and Access Control
  • Business Communications and Productivity Tools
  • Data Protection and Privacy Compliance
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $150,000

Data Exposure

Potential exposure of organizational credentials, browser-stored passwords, authentication tokens, and sensitive business communications. Post-compromise tools observed include credential harvesting utilities and information collection software targeting web browser data stores.

Recommended Actions

  • • Implement Zero Trust Segmentation to restrict lateral movement between network segments and prevent RMM tools from accessing unauthorized resources
  • • Deploy Egress Security & Policy Enforcement to block unauthorized outbound connections to attacker-controlled ScreenConnect infrastructure and prevent data exfiltration
  • • Enable Multicloud Visibility & Control to detect anomalous RMM installations and suspicious remote access tool deployments across hybrid environments
  • • Establish Threat Detection & Anomaly Response capabilities to identify unusual remote management software behavior and credential harvesting activities
  • • Enforce Cloud Firewall (ACF) policies with URL filtering to prevent initial payload downloads from compromised infrastructure and block known malicious domains

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image