Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2645 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RMM/RAT Installer Launched from Web or Email Client

Detects execution of a legitimate remote access / RMM installer (ConnectWise ScreenConnect, SimpleHelp, GoTo/LogMeIn, Datto CentraStage, Heartbeat RM) whose parent process is a browser, email client, or script host. This is the initial-access step of the IAB multi-stage phishing chain (T1566.002/T1204.001), where the malicious link delivers and installs the first-stage RAT foothold.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1219
• Data sources: sysmon, windows_process_creation, device_process_events
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where ParentImage IN ("C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe","C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","C:\\Program Files\\Mozilla Firefox\\firefox.exe","*\\outlook.exe","C:\\Windows\\System32\\wscript.exe","C:\\Windows\\System32\\cscript.exe")
| where Image LIKE "*\\ConnectWiseScreenConnect%.exe" OR Image LIKE "*\\ScreenConnect.ClientService.exe" OR Image LIKE "*\\SimpleHelp%.exe" OR Image LIKE "*\\GoTo%.exe" OR Image LIKE "*\\LogMeIn%.exe" OR Image LIKE "*\\CagService.exe" OR Image LIKE "*\\HeartbeatRM%.exe"
| table _time, host, User, ParentImage, Image, CommandLine
| sort _time desc

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe","outlook.exe","wscript.exe","cscript.exe")
| where FileName matches regex "(?i)(ConnectWiseScreenConnect|ScreenConnect|SimpleHelp|GoTo|LogMeIn|CagService|HeartbeatRM|CentraStage).*\.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

Sigma

title: RMM/RAT Installer Launched from Web or Email Client
id: b1c3a1e2-0001-4f6a-9b2c-111111111111
status: experimental
description: Detects execution of a legitimate remote access / RMM installer from a browser, email client, or scripting host, matching phishing-delivered RMM abuse (TL-2026-2645, T1566.002/T1204.001/T1219).
references:
  - https://cofense.com/blog/the-evolution-of-remote-access-tool-abuse
author: Threadlinqs Team
date: 2026/09/25
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1204.001
  - attack.t1219
  - attack.tool.connectwise
  - attack.tool.simplehelp
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_rmm:
    Image|endswith:
      - '\ConnectWiseScreenConnect*.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\SimpleHelp*.exe'
      - '\GoTo*.exe'
      - '\LogMeIn*.exe'
      - '\CagService.exe'
      - '\HeartbeatRM*.exe'
  condition: selection_parent and selection_rmm
falsepositives:
  - Legitimate MSP/helpdesk installing approved remote access tools
  - User-initiated installs of licensed RMM software
level: medium

Known false positives:

• Legitimate MSP/helpdesk installing approved RMM tools
• User-initiated installs of licensed remote access software

Tuning notes: Maintain a curated allow-list of approved RMM installer hashes/paths; correlate the child RMM process with a prior email/browser navigation to the same host to reduce noise. Tune parent-process list to the org's actual browsers/email clients.

• 🔒 RMM Installer Dropped to Temp/Downloads Then Executed (Multi-Stage Chain) · unlock with TL Creds
• 🔒 Masqueraded RMM/Tunnel Binaries and Persistence Run Keys · unlock with TL Creds
• 🔒 RMM/Tunnel Process Initiating C2 or Tunnel Network Connection · unlock with TL Creds
• 🔒 Sigma — RMM/RAT Installer Delivered via Phishing Link · unlock with TL Creds
• 🔒 Sigma — Masqueraded RMM/Tunnel Persistence via Service or Run Key · unlock with TL Creds
• 🔒 Sigma — Outbound RMM C2 / Cloudflare Tunnel Connection · unlock with TL Creds
• 🔒 Legitimate RMM/RAT Installed as Windows Service (Persistence + Masquerade) · unlock with TL Creds
• 🔒 Outbound C2 Callback to RMM/Tunnel Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-2645.

Sample indicators (3 of 23)

• Domain: sordum[.]org
• Domain: verify[.]uniupdate[.]net
• Domain: 03cc[.]centrastage[.]net

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

Technical analysis

ConnectWise RAT, the most commonly observed second-stage tool, can run PowerShell in a way that reduces PowerShell execution logs.

Threat actors are increasingly abusing legitimate remote access and remote monitoring/management (RMM) software as the initial foothold in multi-stage infection chains. Cofense Intelligence observed a steady upward trend in these campaigns from January 2025 through March 2026, shifting from single-payload delivery to a two-stage model. The chain begins with a phishing email containing an embedded link (or, less commonly, an attached document with an embedded link or an attached malicious script). The link leads to a malicious or spoofed website that delivers and installs an initial RAT executable - typically a legitimate tool such as GoTo RAT, Datto RMM, SimpleHelp RAT, or ConnectWise RAT. The installed RAT reaches out to a command-and-control (C2) server, which may provide another malicious URL used to download additional payloads 'if certain requirements are met.' In many cases the second-stage payload is operated by a different threat actor, reflecting the division of labor common to initial access broker (IAB) activity. ConnectWise RAT was the most commonly observed second-stage tool; it can run PowerShell scripts internally in a way that reduces PowerShell execution logs, and additional payloads have included Heartbeat RM, an additional ConnectWise RAT instance, and a utility from sordum[.]org that hides software from the Windows uninstall list. Documented examples include ATR 409595 (Adobe-spoofing email delivering GoTo RAT then ConnectWise RAT), ATR 409165 (title company-spoofing email delivering Datto RMM then ConnectWise RAT), ATR 408664 (invitation-themed email delivering SimpleHelp RAT then ConnectWise RAT), and ATR 410324 (document-themed email delivering ConnectWise RAT then Heartbeat RM and an additional ConnectWise RAT). Parallel public research confirms the pattern: VENOMOUS#HELPER (Securonix) abused signed SimpleHelp and ScreenConnect binaries in SSA-themed phishing across 80+ organizations; Fortra documented Datto CentraStage abused as a C2 channel over HTTPS 443; Sophos documented N-able N-central Take Control weaponized post-compromise; and LogMeIn Resolve/GoTo was distributed via fake invitation executables. Attackers maintain multiple C2s for redundancy and to make blocking all network artifacts harder. Detection and defense hinge on behavioral EDR, a curated allow-list of approved remote access tools, monitoring for unauthorized RMM/RAT installation (T1219), and treating legitimate signed remote-access binaries as untrusted.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1078 Valid Accounts

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Persistence

T1543.003 Create or Modify System Process: Windows Service; T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

Remediation

Patches

• Patch ConnectWise ScreenConnect to 23.9.8 or later (CVE-2024-1708 path traversal and CVE-2024-1709 auth bypass, both in CISA KEV)
• Patch SimpleHelp RMM to the latest version (CVE-2024-57726, CVE-2024-57727 path traversal in KEV, CVE-2024-57728)
• Patch N-able N-central (CVE-2026-18556 and CVE-2026-18577 authentication bypasses exploited in the wild)

Immediate actions

• Train employees to recognize and report phishing - Cofense notes the example attacks bypassed email security and were caught by trained users reporting via the phishing button
• Maintain a curated allow-list of approved remote access tools so deployment of any non-approved RMM/RAT is a clear security policy violation
• Deploy behavioral-based EDR that detects malicious activity instead of alerting only on static file signatures (legitimate signed RAT binaries evade signature detection)

Workarounds

• Isolate or stop unpatched SimpleHelp servers; do not expose RDP to the web
• Block known attacker-controlled RMM C2 endpoints (e.g., attacker-owned ConnectWise cloud URLs and ports, self-hosted ConnectWise default port 8041)
• Hunt for three-letter-named executables (e.g., aaa.exe) per CISA AA25-163A guidance
• Restrict outbound access to cloud RMM platforms to approved accounts and review newly-registered devices/agents

Longer-term hardening

• Monitor for unauthorized installation/use of remote access software (MITRE T1219) and treat new RMM agents, services, or cloudflare tunnels as suspicious
• Enable and retain PowerShell and RMM telemetry logs; hunt for RMM agents invoking PowerShell in ways that suppress execution logs (T1059.001, T1562.001)
• Detect multi-stage download behavior: an initial RAT C2 callback followed by ingress of a second-stage payload (T1105)
• Audit Event IDs 4102/8192/8193 for 'MSP Support' Take Control sessions on N-central managed endpoints (Sophos/Huntress)

Affected and fixed versions

• ConnectWise — ScreenConnect (ConnectWise RAT / Control)
  Vulnerable versions: 23.9.7 and prior (CVE-2024-1708/1709)
  Fixed in: 23.9.8+
• SimpleHelp — SimpleHelp RMM
  Vulnerable versions: 5.5.7 and prior (CVE-2024-57727)
  Fixed in: latest release
• N-able — N-central
  Vulnerable versions: versions prior to hotfix for CVE-2026-18556/CVE-2026-18577
  Fixed in: N-central hotfix
• Datto — Datto RMM (CentraStage)
  Vulnerable versions: abused as-is (no vulnerability required)
• GoTo — GoTo Resolve / LogMeIn (GoTo RAT)
  Vulnerable versions: abused as-is (no vulnerability required)

Timeline

• 2024-10-01 Brazilian Portuguese-language campaign begins spoofing labor court legal notices and invoices to deliver Atera then Splashtop RMM (Cofense 'New Weapon of Choice').
• 2025-01-06 SimpleHelp remote support vulnerabilities (incl. CVE-2024-57727 path traversal) disclosed to the vendor by Horizon3 researchers.
• 2025-01-22 ArcticWolf identifies a malicious campaign running on vulnerable SimpleHelp RMM servers; ransomware actors have exploited unpatched SimpleHelp since January 2025.
• 2025-02-05 files[.]fm-spoofing campaign begins; emails claim a PDF was received and lure users to download a fake OneDrive client that deploys a legitimate RAT.
• 2025-02-13 CVE-2024-57727 (SimpleHelp path traversal) added to the CISA Known Exploited Vulnerabilities catalog.
• 2025-10-01 Phishing campaign (Oct-Nov 2025) attempts to trick users into installing LogMeIn Resolve (GoTo RAT) for remote unattended access; 80+ organizations, mostly US (Sophos MDR).
• 2026-04-28 CVE-2024-1708 (ConnectWise ScreenConnect path traversal) added to the CISA KEV catalog; attackers chain it with the CVE-2024-1709 auth bypass.
• 2026-07-29 Cofense Intelligence publishes 'The Evolution of Remote Access Tool Abuse', documenting a steady upward trend in multi-stage legitimate-RAT campaigns from Jan 2025 to Mar 2026 and IAB monetization.

Sources cited

• CISA Advisory AA25-163A - Ransomware Actors Exploit Unpatched SimpleHelp RMM CISA · Government advisory · 2025-06-12
• NVD CVE-2024-1708 (ConnectWise ScreenConnect path traversal) NVD (NIST) · Advisory · 2024-02-20
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-04-28
• Fortra FIRE - Datto CentraStage RMM abused as C2 channel fortra.com · Research · 2025-06-15
• The Evolution of Remote Access Tool Abuse: From Single Payloads to Multi-Stage Campaigns (Cofense Intelligence) cofense.com · Blog · 2026-07-29
• New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools (Cofense) cofense.com · Blog · 2025-05-21
• VENOMOUS#HELPER: Dual RMM Phishing Campaign Using SimpleHelp and ScreenConnect (Securonix) securonix.com · Blog · 2025-02-01
• Sophos CTU - N-able N-central exploitation results in RMM tool deployment Sophos · Blog · 2026-01-20
• Sophos MDR - Incident responders, s'il vous plait (LogMeIn Resolve / GoToResolve phishing) Sophos · Blog · 2025-11-30
• KnowBe4 - RMM Tool Abuse as a Skeleton Key (GoTo Resolve / LogMeIn) knowbe4.com · Blog · 2025-12-15
• Huntress - Critical N-able N-central Vulnerability and Active Exploitation Huntress · Blog · 2026-01-18

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Other reports on CVE-2024-1708

• Emperador Ransomware Group Claims 3.9GB Data Theft from AB InBev (Budweiser, Corona Maker) - Unverified $1M Bitcoin Extortion
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569
• The Remote Access Blind Spot: Acronis TRU Analysis of RMM Tool Proliferation and Abuse Risk in SMB Environments
• ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) Added to CISA KEV — Storm-1175 / Medusa Ransomware Active Exploitation
• Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi

Other reports on CVE-2024-1709

• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• Capita Black Basta Ransomware Incident (March 2023) — Record £14M UK ICO Fine for 6M+ Affected Individuals
• APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting
• Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)
• Lazarus Group Medusa Ransomware — North Korean State-Backed Extortion Targeting US Healthcare and Middle East
• Black Basta Ransomware: Internal Chat Leaks Expose $100M+ RaaS Operation — Conti Successor Unmasked

Previous and next in malware

• TokenGrabber: Python-based MaaS Infostealer Builder Previous report
• SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering Next report

Further reading

• Screensaver (.SCR) Files as Initial Access