RMM Scams: How They Work

Remote Monitoring and Management tools are widely used by managed service providers, system administrators, and internal IT teams to manage endpoints at scale.

Because RMM agents are legitimate, digitally signed, and designed to provide persistent privileged access, they have also become attractive to threat actors.

In an RMM scam, the attacker does not necessarily exploit a software vulnerability. Instead, they use social engineering, compromised credentials, or deceptive deployment methods to install legitimate remote-management software on a target system.

Why RMM Tools Are Valuable to Attackers
Once deployed, an RMM agent may provide capabilities comparable to a lightweight command-and-control framework, including:

• Interactive desktop access
• Remote shell and PowerShell execution
• File upload and download
• Process and service management
• Software deployment
• System information collection
• Persistent unattended access
• Execution through privileged service accounts

Unlike custom malware, RMM traffic may blend into legitimate administrative activity and use trusted vendor infrastructure, valid certificates, and encrypted communication channels.

Common Initial Access Methods
1. Social Engineering
Attackers impersonate support personnel, service providers, financial institutions, software vendors, or internal IT departments.

The victim is directed to a website and instructed to download what appears to be a document, invoice, report, agreement, or support file.

In reality, the downloaded file is an executable that installs or launches an RMM client.

2. Fake Document Download Pages
   One of the most effective delivery methods is a web page designed to make an executable file appear to be a normal document.

The page may display:

1. A document-style file name
2. A PDF, Word, invoice, or cloud-storage icon
3. A large Download or View Document button
4. Fake file size and upload information
5. Branding copied from a trusted document-sharing platform

The objective is to prevent the user from realizing that the downloaded file ends with .exe, .msi, .scr, or another executable extension.

Example of a fake document download page delivering an executable file
Example of a page designed to present an executable download as a normal document.
These pages commonly exploit hidden file extensions, misleading button labels, fake previews, and familiar document-sharing interfaces.

A file may be displayed as:

Confidential Agreement.pdf

while the actual downloaded file is:

Confidential Agreement.pdf.exe

On systems where known file extensions are hidden, the victim may only see the apparent PDF portion of the name.

Read the full article: https://scantra.org/en/blog/rmm-scams-how-they-work