Table of Contents
Introduction
Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.
"Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software."
— Microsoft Security Research TeamThis blog is based on reporting by Ravie Lakshmanan (September 30, 2026). The activity has not been attributed to any known threat actor or group.
What Happened: The Dual-RMM Attack
The attack uses a two-stage RMM deployment strategy. Attackers first deploy MSP360 to gain an initial foothold, then use it to install ConnectWise ScreenConnect as a redundant remote-access channel.
The initial foothold is then used to:
- Download and install a ConnectWise ScreenConnect client — Providing threat actors with a redundant remote-access channel to compromised endpoints
- Deliver additional tools — Expanding attacker capabilities on the endpoint
- Carry out information collection — Gathering data from the compromised system
- Perform credential-access operations — Stealing credentials to move laterally
The dual-RMM approach is significant: if defenders detect and block one RMM tool, the attacker has a second channel already installed and ready to use.
The Deceptive Filenames
The attackers are distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names designed to look like legitimate business documents or software:
| Deceptive Filename | Lure Type |
|---|---|
| VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe | E-card invitation |
| ZoomSetup_Installation_v2.5.0.67_ oid[redacted].exe | Zoom installer |
| PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_ oid[redacted].exe | PDF reader (misspelled "Acrobat") |
| RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_ oid[redacted].exe | RSVP invitation |
| SSA.GOV_STATEMENT_rmm_v2.5.0.67_ oid[redacted].exe | Government statement (SSA) |
Notice the rmm_v2.5.0.67 in every filename — that's the version identifier for MSP360 RMM. Attackers are hoping victims won't notice the unusual naming pattern.
Staging on Legitimate Cloud Services
The installer packages are staged on both attacker-controlled infrastructure and legitimate cloud services, making detection harder:
- Amazon S3 — AWS object storage
- Cloudflare R2 — Cloudflare's object storage
- Dropbox — Consumer file-sharing service
- GitLab — Code hosting platform
- Supabase — Open-source Firebase alternative
Using legitimate services for staging is a growing trend. Security tools that block unknown domains won't help when the payload is hosted on S3, Dropbox, or GitLab — all trusted services.
The Full Attack Chain
Here's how the multi-stage intrusion unfolds:
| Stage | Action |
|---|---|
| 1. Initial lures | Phishing emails arrive with deceptive filenames (e-cards, Zoom installers, PDF readers, etc.) |
| 2. Distribution | Digitally signed MSP360 RMM v2.5.0.67 installer is served from attacker infrastructure or legitimate cloud services |
| 3. Execution | User runs the installer, which drops multiple DLLs |
| 4. Privilege escalation | Installer relaunches itself by invoking Windows UAC elevation to run in a privileged context |
| 5. Persistence | MSP360 RMM is installed, establishing persistent remote management access |
| 6. Secondary RMM | MSP360 is leveraged to execute PowerShell, which stealthily installs ConnectWise ScreenConnect |
| 7. Post-exploitation | Attackers use the dual RMM access to deliver tools, collect information, and access credentials |
Note the use of digitally signed installers and UAC elevation — both of which would normally raise fewer flags than unsigned binaries or suspicious privilege requests.
Why Attackers Abuse RMM Tools
RMM abuse is a growing attack pattern, and it's easy to see why:
Trusted by Defenders
RMM tools are legitimate software used by MSPs and IT teams every day. Blocking them outright isn't practical.
Digital Signatures
Legitimate RMM installers are often digitally signed. This can bypass reputation-based security controls.
Persistent Access
RMM tools establish ongoing remote access, giving attackers a durable foothold.
Redundancy
Deploying two RMM tools means defenders must catch both to fully remove the attacker.
RMM abuse isn't going away. As defenders get better at detecting individual RMM tools, attackers will deploy multiple — just like this campaign does.
Why This Matters for Every Business
This attack is a reminder that the tools IT teams trust can be turned against them. Here's why every business should pay attention:
- Digital signatures aren't a silver bullet — The MSP360 installer was legitimately signed. Attackers are abusing trust signals.
- Cloud services complicate blocking — You can't just block S3, Dropbox, or GitLab without breaking legitimate business workflows.
- User awareness still matters — The attack starts with phishing. Employees who recognize deceptive filenames are the first line of defense.
- RMM tools need strict controls — If your environment allows arbitrary RMM installations, you have a significant exposure.
- Multiple RMM tools are a red flag — If your environment has more than one RMM installed without a business reason, investigate.
- Detection requires monitoring — Endpoint detection and response (EDR) is essential to catch these attacks in progress.
If your organization doesn't have controls on which RMM tools can be installed, this attack chain could succeed against your users. Most businesses don't realize how exposed they are.
Why Businesses Rely on Managed IT Services for RMM Defense
Here's the reality: most small and mid-sized businesses don't have the tools, visibility, or expertise to defend against RMM abuse. They may not know what RMM tools are running on their endpoints. They may not have EDR. And they may not know how to respond when a dual-RMM attack is detected.
That's where Managed IT Services (MSPs) come in. A modern MSP provides the visibility, controls, and rapid response required to defend against this class of attack.
What a Managed IT Services Partner Does for RMM Defense
When attackers abuse RMM tools, your MSP partner should already have the controls in place. Here's what that looks like:
- Application allowlisting — Only approved RMM tools can run on your endpoints
- Endpoint Detection and Response (EDR) — Detecting suspicious RMM installations and process behavior
- RMM inventory and monitoring — Knowing exactly which RMM tools are installed and by whom
- Controlled administrative access — Preventing unauthorized UAC elevation
- Email security — Filtering phishing messages before they reach users
- User awareness training — Teaching employees to recognize deceptive filenames and lures
- Cloud service controls — Restricting which cloud services can be used for downloads in your environment
- PowerShell logging — Capturing script execution for detection and forensics
- Rapid incident response — Removing malicious RMM tools and reversing attacker access
- Post-incident hardening — Adjusting controls based on what was learned
Why SMBs Choose Managed IT Over DIY
For most organizations, defending against RMM abuse isn't feasible without dedicated expertise:
- You can't detect what you can't see — Most SMBs have limited visibility into what's actually running on endpoints
- EDR is expensive and complex — Effective endpoint detection requires tooling and staff to operate it
- RMM tools look legitimate — Traditional signature-based antivirus won't catch this
- Cloud service blocking is nuanced — You need to allow legitimate use while catching abuse
- Response requires speed — Attackers with persistent access need to be removed quickly
- Skill gap — RMM abuse defense is a specialized, evolving discipline
If your organization doesn't have application allowlisting, EDR, and RMM monitoring in place — a Managed IT Services partner can help you close the gap.
What to Ask a Potential MSP Partner About RMM Defense
If you're evaluating MSPs (or wondering whether your current one is doing enough), ask these questions:
- Do you have application allowlisting for RMM tools?
- Can you inventory every RMM tool installed across our environment?
- Do you have EDR that detects suspicious RMM installations?
- How do you control UAC elevation in our environment?
- Do you monitor for PowerShell execution?
- What cloud services are allowed for downloads?
- How quickly can you respond if malicious RMM tools are detected?
- Do you provide user awareness training on deceptive filenames and phishing?
At SystemLogicIT, we provide Managed IT Services and Cyber Threat Protection tailored to businesses across the United States and United Kingdom. If your organization needs help defending against RMM abuse or building layered endpoint security, we'd be glad to talk.
What Businesses Should Do
Whether you manage IT in-house or through a partner, here's a practical checklist based on this attack:
- Inventory RMM tools — Know every RMM tool installed in your environment
- Implement application allowlisting — Only approved RMM tools should be able to run
- Deploy EDR — If you don't have endpoint detection and response, get it
- Control UAC elevation — Review which users can elevate to administrator and how
- Monitor PowerShell — Enable logging for script execution across endpoints
- Restrict cloud service downloads — Where possible, block or monitor downloads from S3, Dropbox, GitLab, etc.
- Harden email security — Filter phishing messages, especially those with attachments
- Train users — Teach employees to spot deceptive filenames and suspicious attachments
- Watch for dual RMM — A second RMM tool appearing on an endpoint is a red flag
- Prepare incident response — Have a plan for detecting and removing malicious RMM tools
If your organization needs help with RMM inventory, application allowlisting, EDR deployment, or incident response, consider working with a Managed IT Services partner.
Final Thoughts
The MSP360-to-ScreenConnect dual-RMM attack is a clever evolution of a pattern that's been growing for years. Attackers have realized that RMM tools are trusted, signed, and hard to block — so they're using them to establish persistent access.
The dual-RMM approach adds a layer of difficulty for defenders: even if you detect and remove one RMM tool, the second one keeps the attacker in your environment.
For most small and mid-sized businesses, defending against this class of attack requires capabilities they don't have in-house. That's why Managed IT Services partners exist — to provide the visibility, controls, and expertise needed to keep pace with evolving attacker techniques.
Key takeaways:
- Dual-RMM attack — Attackers deploy MSP360 first, then ScreenConnect for redundancy
- Deceptive filenames — E-cards, Zoom installers, PDF readers, RSVP invitations, SSA statements
- Digitally signed installer — The MSP360 RMM v2.5.0.67 installer was legitimately signed
- Staged on cloud services — Amazon S3, Cloudflare R2, Dropbox, GitLab, Supabase
- UAC elevation — Installer relaunches itself with elevated privileges
- PowerShell used for second RMM — MSP360 executes PowerShell to install ScreenConnect
- Detected July 2026 — Microsoft identified the campaign; no attribution yet
- RMM abuse is growing — Trusted tools, digital signatures, and redundancy make this pattern effective
- Defense requires visibility — Application allowlisting, EDR, RMM inventory, and monitoring
- Managed IT Services bridge the gap — Controls, expertise, and rapid response
If your organization needs help defending against RMM abuse, building endpoint controls, or responding to sophisticated phishing attacks, contact SystemLogicIT for expert Managed IT Services and Cyber Threat Protection across the United States and United Kingdom.