Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers
Multi-Stage Abuse of Legitimate Remote Access Tools (TL-2026-2645) is a high-severity malware campaign, first published 2026-09-25. It is attributed to Initial Access Brokers with low confidence, affects ConnectWise ScreenConnect (ConnectWise RAT / Control), maps to 13 MITRE ATT&CK techniques (T1036, T1059.001, T1071.001), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2645
- Threat ID
- TL-2026-2645
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-25
- Last reviewed
- 2026-09-25
- Attribution
- Initial Access Brokers
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, legal, health, corporate
- Target regions
- North America, Europe, Latin America
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Multi-Stage Abuse of Legitimate Remote Access Tools
Malware and tooling: AsyncRAT, ConnectWise RAT, Datto RMM, GoTo RAT, Heartbeat RM, N-Able RAT, Remcos, SimpleHelp RAT, XWorm, XWorm RAT, CentraStage (Now Datto), CloudFlare Tunnel
Cofense Intelligence reports a steady upward trend (Jan 2025-Mar 2026) in multi-stage phishing campaigns that deliver legitimate remote access tools (RATs/RMMs: ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo, Heartbeat RM) as an initial foothold. Initial access brokers (IABs) monetize the infections by selling access to compromised machines, and a second-stage RAT/payload operated by a different actor is frequently downloaded over C2. ConnectWise RAT, the most commonly observed second-stage tool, can run PowerShell in a way that reduces PowerShell execution logs.
How Multi-Stage Abuse of Legitimate Remote Access Tools works
Threat actors are increasingly abusing legitimate remote access and remote monitoring/management (RMM) software as the initial foothold in multi-stage infection chains. Cofense Intelligence observed a steady upward trend in these campaigns from January 2025 through March 2026, shifting from single-payload delivery to a two-stage model. The chain begins with a phishing email containing an embedded link (or, less commonly, an attached document with an embedded link or an attached malicious script). The link leads to a malicious or spoofed website that delivers and installs an initial RAT executable - typically a legitimate tool such as GoTo RAT, Datto RMM, SimpleHelp RAT, or ConnectWise RAT. The installed RAT reaches out to a command-and-control (C2) server, which may provide another malicious URL used to download additional payloads 'if certain requirements are met.' In many cases the second-stage payload is operated by a different threat actor, reflecting the division of labor common to initial access broker (IAB) activity. ConnectWise RAT was the most commonly observed second-stage tool; it can run PowerShell scripts internally in a way that reduces PowerShell execution logs, and additional payloads have included Heartbeat RM, an additional ConnectWise RAT instance, and a utility from sordum[.]org that hides software from the Windows uninstall list. Documented examples include ATR 409595 (Adobe-spoofing email delivering GoTo RAT then ConnectWise RAT), ATR 409165 (title company-spoofing email delivering Datto RMM then ConnectWise RAT), ATR 408664 (invitation-themed email delivering SimpleHelp RAT then ConnectWise RAT), and ATR 410324 (document-themed email delivering ConnectWise RAT then Heartbeat RM and an additional ConnectWise RAT). Parallel public research confirms the pattern: VENOMOUS#HELPER (Securonix) abused signed SimpleHelp and ScreenConnect binaries in SSA-themed phishing across 80+ organizations; Fortra documented Datto CentraStage abused as a C2 channel over HTTPS 443; Sophos documented N-able N-central Take Control weaponized post-compromise; and LogMeIn Resolve/GoTo was distributed via fake invitation executables. Attackers maintain multiple C2s for redundancy and to make blocking all network artifacts harder. Detection and defense hinge on behavioral EDR, a curated allow-list of approved remote access tools, monitoring for unauthorized RMM/RAT installation (T1219), and treating legitimate signed remote-access binaries as untrusted.
MITRE ATT&CK techniques used in TL-2026-2645
Defense Evasion
T1036 Masquerading; T1078 Valid Accounts
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Persistence
T1543.003 Create or Modify System Process: Windows Service; T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
Affected products and versions in Multi-Stage Abuse of Legitimate Remote Access Tools
- ConnectWise — ScreenConnect (ConnectWise RAT / Control)
Vulnerable versions: 23.9.7 and prior (CVE-2024-1708/1709)
Fixed in: 23.9.8+ - SimpleHelp — SimpleHelp RMM
Vulnerable versions: 5.5.7 and prior (CVE-2024-57727)
Fixed in: latest release - N-able — N-central
Vulnerable versions: versions prior to hotfix for CVE-2026-18556/CVE-2026-18577
Fixed in: N-central hotfix - Datto — Datto RMM (CentraStage)
Vulnerable versions: abused as-is (no vulnerability required) - GoTo — GoTo Resolve / LogMeIn (GoTo RAT)
Vulnerable versions: abused as-is (no vulnerability required)
Remediation for Multi-Stage Abuse of Legitimate Remote Access Tools
Patches
- Patch ConnectWise ScreenConnect to 23.9.8 or later (CVE-2024-1708 path traversal and CVE-2024-1709 auth bypass, both in CISA KEV)
- Patch SimpleHelp RMM to the latest version (CVE-2024-57726, CVE-2024-57727 path traversal in KEV, CVE-2024-57728)
- Patch N-able N-central (CVE-2026-18556 and CVE-2026-18577 authentication bypasses exploited in the wild)
Immediate actions
- Train employees to recognize and report phishing - Cofense notes the example attacks bypassed email security and were caught by trained users reporting via the phishing button
- Maintain a curated allow-list of approved remote access tools so deployment of any non-approved RMM/RAT is a clear security policy violation
- Deploy behavioral-based EDR that detects malicious activity instead of alerting only on static file signatures (legitimate signed RAT binaries evade signature detection)
Workarounds
- Isolate or stop unpatched SimpleHelp servers; do not expose RDP to the web
- Block known attacker-controlled RMM C2 endpoints (e.g., attacker-owned ConnectWise cloud URLs and ports, self-hosted ConnectWise default port 8041)
- Hunt for three-letter-named executables (e.g., aaa.exe) per CISA AA25-163A guidance
- Restrict outbound access to cloud RMM platforms to approved accounts and review newly-registered devices/agents
Longer-term hardening
- Monitor for unauthorized installation/use of remote access software (MITRE T1219) and treat new RMM agents, services, or cloudflare tunnels as suspicious
- Enable and retain PowerShell and RMM telemetry logs; hunt for RMM agents invoking PowerShell in ways that suppress execution logs (T1059.001, T1562.001)
- Detect multi-stage download behavior: an initial RAT C2 callback followed by ingress of a second-stage payload (T1105)
- Audit Event IDs 4102/8192/8193 for 'MSP Support' Take Control sessions on N-central managed endpoints (Sophos/Huntress)
Timeline of Multi-Stage Abuse of Legitimate Remote Access Tools
- Brazilian Portuguese-language campaign begins spoofing labor court legal notices and invoices to deliver Atera then Splashtop RMM (Cofense 'New Weapon of Choice').
- SimpleHelp remote support vulnerabilities (incl. CVE-2024-57727 path traversal) disclosed to the vendor by Horizon3 researchers.
- ArcticWolf identifies a malicious campaign running on vulnerable SimpleHelp RMM servers; ransomware actors have exploited unpatched SimpleHelp since January 2025.
- files[.]fm-spoofing campaign begins; emails claim a PDF was received and lure users to download a fake OneDrive client that deploys a legitimate RAT.
- CVE-2024-57727 (SimpleHelp path traversal) added to the CISA Known Exploited Vulnerabilities catalog.
- Phishing campaign (Oct-Nov 2025) attempts to trick users into installing LogMeIn Resolve (GoTo RAT) for remote unattended access; 80+ organizations, mostly US (Sophos MDR).
- CVE-2024-1708 (ConnectWise ScreenConnect path traversal) added to the CISA KEV catalog; attackers chain it with the CVE-2024-1709 auth bypass.
- Cofense Intelligence publishes 'The Evolution of Remote Access Tool Abuse', documenting a steady upward trend in multi-stage legitimate-RAT campaigns from Jan 2025 to Mar 2026 and IAB monetization.
Sources cited for Multi-Stage Abuse of Legitimate Remote Access Tools
- The Evolution of Remote Access Tool Abuse: From Single Payloads to Multi-Stage Campaigns (Cofense Intelligence)
- New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools (Cofense)
- VENOMOUS#HELPER: Dual RMM Phishing Campaign Using SimpleHelp and ScreenConnect (Securonix)
- CISA Advisory AA25-163A - Ransomware Actors Exploit Unpatched SimpleHelp RMM
- NVD CVE-2024-1708 (ConnectWise ScreenConnect path traversal)
- CISA Known Exploited Vulnerabilities Catalog
- Fortra FIRE - Datto CentraStage RMM abused as C2 channel
- Sophos CTU - N-able N-central exploitation results in RMM tool deployment
- Sophos MDR - Incident responders, s'il vous plait (LogMeIn Resolve / GoToResolve phishing)
- KnowBe4 - RMM Tool Abuse as a Skeleton Key (GoTo Resolve / LogMeIn)
- Huntress - Critical N-able N-central Vulnerability and Active Exploitation
More in malware
- Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs
- Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD)
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering
- TokenGrabber: Python-based MaaS Infostealer Builder
Detection coverage for TL-2026-2645
As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2645 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.