# The Remote Access Blind Spot: Acronis TRU Analysis of RMM Tool Proliferation and Abuse Risk in SMB Environments

> Acronis' Threat Research Unit analyzed telemetry from 1.8M+ endpoints (Jan 2025-Mar 2026) and found 63% run more than one RMM tool, with over a third running three or more, expanding the attack surface that ransomware crews and access brokers exploit by deploying legitimate or open-source RMM software (AnyDesk, ScreenConnect, TeamViewer, MeshAgent, RDP, VNC/UltraVNC) to blend in with trusted traffic.

- **Published:** 2026-05-13T00:00:00Z
- **Last reviewed:** 2026-05-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2115
- **ID:** TL-2026-2115
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8875, CVE-2025-8876, CVE-2025-9316, CVE-2025-11366, CVE-2025-11367, CVE-2025-3935, CVE-2025-14265, CVE-2025-0065, CVE-2025-36537, CVE-2024-1708, CVE-2024-1709

## Description

Acronis TRU's telemetry study of 1.8 million-plus endpoints running its RMM agent between January 2025 and March 2026 quantifies a structural SMB exposure: 63% of monitored endpoints run more than one remote monitoring and management tool, and over a third run three or more concurrently. The report identifies the most-abused tools as open-source or leaked-source-code utilities such as MeshAgent (whose public source lets threat actors recompile it into custom implants), plus ubiquitous protocols/tools RDP and VNC/UltraVNC. Because RMM traffic is functionally identical to legitimate IT-support activity and typically carries elevated, application-control-exempt privileges (MITRE ATT&CK T1219, 'commonly used as legitimate technical support software and may be allowed by application control'), it routinely evades anomaly-based network detection.

This is not a theoretical exposure. CISA/NSA/MS-ISAC documented the pattern as early as October 2022 in Advisory AA23-025A: phishing lures directed victims to help-desk-themed domains that delivered portable, no-install AnyDesk and ScreenConnect executables configured to phone home to actor-controlled RMM servers, initially for refund-scam fraud (MITRE T1657) and later as a template for broader intrusion tradecraft. That same tool-abuse pattern now underpins major ransomware operations: LockBit 3.0, Black Basta, and Akira affiliates routinely install AnyDesk, Splashtop, ScreenConnect, TeamViewer, Tactical RMM, and Pulseway post-compromise for persistent, low-noise access before deploying ransomware (Halcyon.ai tracks AnyDesk use by LockBit and Akira as recently as November 2025); one public LockBit case had affiliates exploit a Confluence RCE, pull AnyDesk via a Metasploit stager, and detonate ransomware within two hours. Scattered Spider layers this with help-desk-impersonation vishing/smishing to socially engineer IT staff into installing RMM tools directly, then uses that access for MFA-factor manipulation and lateral movement.

The underlying RMM platforms are themselves an active vulnerability surface. Acronis TRU's own 2025 tally — cited in this report — counts TeamViewer with 19 disclosed CVEs (two critical), N-able with 8, ConnectWise ScreenConnect with 2 additional CVEs (on top of the widely-exploited 2024 ScreenConnect auth-bypass/path-traversal chain, CVE-2024-1708/1709), and AnyDesk with 2, with every 2025 RMM platform vulnerability disclosure rated high or critical. Concretely: N-able N-central's CVE-2025-8875 (deserialization, CVSS 9.4) and CVE-2025-8876 (improper input validation, CVSS 9.4) were both added to CISA's KEV catalog after in-the-wild exploitation, with over 1,000 unpatched internet-exposed N-central instances identified; ConnectWise ScreenConnect's CVE-2025-3935 (ViewState code injection) was added to KEV in June 2025 after ConnectWise reported suspected nation-state activity against a subset of customers; TeamViewer's CVE-2025-0065 and CVE-2025-36537 are local privilege-escalation flaws in the Windows client/service that let an already-landed attacker jump to SYSTEM.

The net effect documented by Acronis is a compounding blind spot for resource-constrained SMBs and their MSPs: multiple overlapping RMM agents per endpoint increase both the exploitable surface (more vulnerable software to patch) and the living-off-the-land opportunity (more "legitimate" channels an attacker can hide inside), while the perceived legitimacy of RMM traffic suppresses the anomaly signals that would otherwise flag privilege escalation, lateral movement, and ransomware staging in progress.

## MITRE ATT&CK

- T1583.001 Domains
- T1566 Phishing
- T1133 External Remote Services
- T1204.002 Malicious File
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1110.004 Credential Stuffing
- T1021.001 Remote Desktop Protocol
- T1021.005 VNC
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1657 Financial Theft

## Sources

- [The remote access blind spot: An analysis of RMM tool risk for SMBs](https://www.acronis.com/en/tru/posts/the-remote-access-blind-spot-an-analysis-of-rmm-tool-risk-for-smbs/)
- [Phishing-to-RMM Attacks: The Blind Spot CISOs Need to Close](https://any.run/cybersecurity-blog/rmm-blind-spot-for-cisos/)
- [Alert (AA23-025A): Protecting Against Malicious Use of Remote Monitoring and Management Software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a)
- [AnyDesk in Ransomware Operations: IOC & TTP Index](https://www.halcyon.ai/ioc-ttp-index/anydesk-in-ransomware-operations)
- [Vulnerabilities in MSP-friendly RMM solution exploited in the wild (CVE-2025-8875, CVE-2025-8876)](https://www.helpnetsecurity.com/2025/08/14/vulnerabilities-in-msp-friendly-rmm-solution-exploited-in-the-wild-cve-2025-8875-cve-2025-8876/)
- [CVE-2025-36537: TeamViewer Privilege Escalation Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2025-36537/)
- [Remediation and Hardening Guide for ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)](https://cloud.google.com/blog/topics/threat-intelligence/connectwise-screenconnect-hardening-remediation)
- [ConnectWise ScreenConnect Command Injection Vulnerability Added to CISA KEV (CVE-2025-3935)](https://threatprotect.qualys.com/2025/06/04/connectwise-screenconnect-command-injection-vulnerability-added-to-cisa-kev-cve-2025-3935/)
- [LOLRMM: A Unified Approach to RMM Software Tracking](https://github.com/magicsword-io/LOLRMM)
- [Scattered Spider (Joint Cybersecurity Advisory Update)](https://www.ic3.gov/CSA/2025/250729.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2115