When the legitimate tool is the intrusion
How criminals use RMM software to Bypass the controls designed to stop them
A remote support session opens on a computer. The software is a commercial remote monitoring and management (RMM) platform. Its publisher is trusted, its installer is digitally signed, and it’s probably not on your organization’s block list.
The person on the other end might be your help desk or it might be someone who was recruited, trained, and paid to sound like your help desk: “Mark from IT,” a fraudster who doesn’t work for your company and who may not even be a human.
But this session could also be running on your customer’s personal device. The caller says they’re from your fraud department and they walk your customer through installing that same tool.
To the controls in place to catch fraud, these sessions look identical. Both use the same tool, the same signature, and the same traffic to the same legitimate domains. Spotting these sessions is the kind of work Q6 does for banks and credit unions every day: collecting information from the Dark Web and private criminal channels and delivering our analysts’ findings to our clients’ fraud teams so they can act on it before fraud can occur.
What RMM tools are
RMM platforms are built for IT administration. Internal IT teams use them to manage corporate endpoints, help desks use them for remote support sessions, and organizations with hybrid workforces or several locations rely on them to manage devices from a distance. They’re designed to provide persistent, interactive access to a system, and to keep running quietly in the background.
These are the same qualities that make them attractive to attackers.
Why attackers use them
Compared with the effort of building custom malware, RMM software offers several advantages:
- It’s commercial software that is often pre-approved.
- It’s digitally signed.
- It’s widely deployed, so its presence on a machine rarely raises questions.
- Its network traffic goes to legitimate domains.
- The attacker does not have to develop or maintain their own infrastructure.
The capabilities also line up closely with those of a traditional remote access trojan (RAT). An unattended background service gives the attacker a persistent foothold. A cloud admin dashboard stands in for a command-and-control server. Remote command execution, live screen visibility, and file transfer are built in, and fleet management does the work of a botnet panel. The difference is that the software comes from a legitimate vendor.
Attackers also don’t need to limit themselves to the organization’s own endpoints. Customers and other end users sit outside corporate controls, on personal devices with no endpoint detection and no security team watching. Because RMM tools are legitimate, a customer who is persuaded to install one has little reason to suspect anything is wrong.
The trend
Dark Reading reported a 277% year-over-year rise in RMM abuse in 2026. Our April 2025 analysis of ransomware operations, compromised credentials were the leading initial access route at 52.3%, followed by social engineering calls at 19.4%. These calls often end with the victim installing a remote access tool.
Why this matters to financial institutions
Many detection programs are built to find malicious files and unfamiliar infrastructure. An attack that uses approved software, and often has the user run it, gives those controls no reason to flag it. Stronger authentication doesn’t fully close the gap either, because the attacker is working from the customer’s own device.
The same approach works on both employees and customers, and the end goal is often financial fraud. When the target is a customer, the institution’s perimeter is not involved at all. The customer opens the banking app, authenticates normally and may even approve the transaction, all while a criminal watches the screen or controls the mouse. From the institution’s side, the session can look like a legitimate customer on a familiar device – except the customer is about to lose money and the institution will end up absorbing the reputational damage and the support burden while increasingly facing regulatory and reimbursement pressure.
What our analysts have observed
This post draws on research by Dima Khrustalov, who leads Q6 Cyber’s research team and is the author of the report “When Legitimate Tools Become Malware: The Criminal Abuse of RMM Platforms.”
Dima presented his findings in our recent webinar, covering what our analysts have seen in the places where these operations are organized.
The session addressed:
- How these operations are staffed
- How access is delivered, both to individual targets and across many devices at once
- What happens after access is established
- Defensive steps, including some outside the usual security stack
You can watch the full webinar recording here.
To see what’s already circulating about your institution, complete this form and a member of our team will be in touch.