# Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers

> Cofense Intelligence reports a steady upward trend (Jan 2025-Mar 2026) in multi-stage phishing campaigns that deliver legitimate remote access tools (RATs/RMMs: ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo, Heartbeat RM) as an initial foothold. Initial access brokers (IABs) monetize the infections by selling access to compromised machines, and a second-stage RAT/payload operated by a different actor is frequently downloaded over C2. ConnectWise RAT, the most commonly observed second-stage tool, can run PowerShell in a way that reduces PowerShell execution logs.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2645
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-rmm-remote-access-abuse-tl-2026-2645.webp?v=66aa70d5 (Threadlinqs threat intel: Initial Access Brokers Exploit RMM Tools: Detection & IOCs (TL-2026-2645) — High severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-2645
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Initial Access Brokers
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2024-1708, CVE-2024-1709, CVE-2026-18556, CVE-2026-18577

## Description

Threat actors are increasingly abusing legitimate remote access and remote monitoring/management (RMM) software as the initial foothold in multi-stage infection chains. Cofense Intelligence observed a steady upward trend in these campaigns from January 2025 through March 2026, shifting from single-payload delivery to a two-stage model. The chain begins with a phishing email containing an embedded link (or, less commonly, an attached document with an embedded link or an attached malicious script). The link leads to a malicious or spoofed website that delivers and installs an initial RAT executable - typically a legitimate tool such as GoTo RAT, Datto RMM, SimpleHelp RAT, or ConnectWise RAT. The installed RAT reaches out to a command-and-control (C2) server, which may provide another malicious URL used to download additional payloads 'if certain requirements are met.' In many cases the second-stage payload is operated by a different threat actor, reflecting the division of labor common to initial access broker (IAB) activity. ConnectWise RAT was the most commonly observed second-stage tool; it can run PowerShell scripts internally in a way that reduces PowerShell execution logs, and additional payloads have included Heartbeat RM, an additional ConnectWise RAT instance, and a utility from sordum[.]org that hides software from the Windows uninstall list. Documented examples include ATR 409595 (Adobe-spoofing email delivering GoTo RAT then ConnectWise RAT), ATR 409165 (title company-spoofing email delivering Datto RMM then ConnectWise RAT), ATR 408664 (invitation-themed email delivering SimpleHelp RAT then ConnectWise RAT), and ATR 410324 (document-themed email delivering ConnectWise RAT then Heartbeat RM and an additional ConnectWise RAT). Parallel public research confirms the pattern: VENOMOUS#HELPER (Securonix) abused signed SimpleHelp and ScreenConnect binaries in SSA-themed phishing across 80+ organizations; Fortra documented Datto CentraStage abused as a C2 channel over HTTPS 443; Sophos documented N-able N-central Take Control weaponized post-compromise; and LogMeIn Resolve/GoTo was distributed via fake invitation executables. Attackers maintain multiple C2s for redundancy and to make blocking all network artifacts harder. Detection and defense hinge on behavioral EDR, a curated allow-list of approved remote access tools, monitoring for unauthorized RMM/RAT installation (T1219), and treating legitimate signed remote-access binaries as untrusted.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1566.001 Phishing: Spearphishing Attachment
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1219 Remote Access Tools
- T1071.001 Application Layer Protocol: Web Protocols
- T1078 Valid Accounts
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1543.003 Create or Modify System Process: Windows Service
- T1547.001 Registry Run Keys / Startup Folder

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RMM/RAT Installer Launched from Web or Email Client** (`TL-2026-2645-SPL-001`)

Detects execution of a legitimate remote access / RMM installer (ConnectWise ScreenConnect, SimpleHelp, GoTo/LogMeIn, Datto CentraStage, Heartbeat RM) whose parent process is a browser, email client, or script host. This is the initial-access step of the IAB multi-stage phishing chain (T1566.002/T1204.001), where the malicious link delivers and installs the first-stage RAT foothold.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1219
- **Data sources:** sysmon, windows_process_creation, device_process_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where ParentImage IN ("C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe","C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","C:\\Program Files\\Mozilla Firefox\\firefox.exe","*\\outlook.exe","C:\\Windows\\System32\\wscript.exe","C:\\Windows\\System32\\cscript.exe")
| where Image LIKE "*\\ConnectWiseScreenConnect%.exe" OR Image LIKE "*\\ScreenConnect.ClientService.exe" OR Image LIKE "*\\SimpleHelp%.exe" OR Image LIKE "*\\GoTo%.exe" OR Image LIKE "*\\LogMeIn%.exe" OR Image LIKE "*\\CagService.exe" OR Image LIKE "*\\HeartbeatRM%.exe"
| table _time, host, User, ParentImage, Image, CommandLine
| sort _time desc
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe","outlook.exe","wscript.exe","cscript.exe")
| where FileName matches regex "(?i)(ConnectWiseScreenConnect|ScreenConnect|SimpleHelp|GoTo|LogMeIn|CagService|HeartbeatRM|CentraStage).*\.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: RMM/RAT Installer Launched from Web or Email Client
id: b1c3a1e2-0001-4f6a-9b2c-111111111111
status: experimental
description: Detects execution of a legitimate remote access / RMM installer from a browser, email client, or scripting host, matching phishing-delivered RMM abuse (TL-2026-2645, T1566.002/T1204.001/T1219).
references:
  - https://cofense.com/blog/the-evolution-of-remote-access-tool-abuse
author: Threadlinqs Team
date: 2026/09/25
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1204.001
  - attack.t1219
  - attack.tool.connectwise
  - attack.tool.simplehelp
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_rmm:
    Image|endswith:
      - '\ConnectWiseScreenConnect*.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\SimpleHelp*.exe'
      - '\GoTo*.exe'
      - '\LogMeIn*.exe'
      - '\CagService.exe'
      - '\HeartbeatRM*.exe'
  condition: selection_parent and selection_rmm
falsepositives:
  - Legitimate MSP/helpdesk installing approved remote access tools
  - User-initiated installs of licensed RMM software
level: medium
```

**Known false positives:**

- Legitimate MSP/helpdesk installing approved RMM tools
- User-initiated installs of licensed remote access software

**Tuning notes:** Maintain a curated allow-list of approved RMM installer hashes/paths; correlate the child RMM process with a prior email/browser navigation to the same host to reduce noise. Tune parent-process list to the org's actual browsers/email clients.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RMM Installer Dropped to Temp/Downloads Then Executed (Multi-Stage Chain) (locked: unlock with TL Creds)
- Masqueraded RMM/Tunnel Binaries and Persistence Run Keys (locked: unlock with TL Creds)
- RMM/Tunnel Process Initiating C2 or Tunnel Network Connection (locked: unlock with TL Creds)
- Sigma — RMM/RAT Installer Delivered via Phishing Link (locked: unlock with TL Creds)
- Sigma — Masqueraded RMM/Tunnel Persistence via Service or Run Key (locked: unlock with TL Creds)
- Sigma — Outbound RMM C2 / Cloudflare Tunnel Connection (locked: unlock with TL Creds)
- Legitimate RMM/RAT Installed as Windows Service (Persistence + Masquerade) (locked: unlock with TL Creds)
- Outbound C2 Callback to RMM/Tunnel Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- Domain: `sordum[.]org`
- Domain: `verify[.]uniupdate[.]net`
- Domain: `03cc[.]centrastage[.]net`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Evolution of Remote Access Tool Abuse: From Single Payloads to Multi-Stage Campaigns (Cofense Intelligence)](https://cofense.com/blog/the-evolution-of-remote-access-tool-abuse)
- [New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools (Cofense)](https://cofense.com/blog/new-weapon-of-choice-how-threat-actors-hijack-legitimate-remote-access-tools)
- [VENOMOUS#HELPER: Dual RMM Phishing Campaign Using SimpleHelp and ScreenConnect (Securonix)](https://www.securonix.com/blog/venomous-helper-phishing-campaign/)
- [CISA Advisory AA25-163A - Ransomware Actors Exploit Unpatched SimpleHelp RMM](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a)
- [NVD CVE-2024-1708 (ConnectWise ScreenConnect path traversal)](https://nvd.nist.gov/vuln/detail/CVE-2024-1708)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Fortra FIRE - Datto CentraStage RMM abused as C2 channel](https://www.fortra.com/resources/fortra-fire-blog)
- [Sophos CTU - N-able N-central exploitation results in RMM tool deployment](https://www.sophos.com/en-us/blog/nable-ncentral-exploitation-results-in-rmm-tool-deployment)
- [Sophos MDR - Incident responders, s'il vous plait (LogMeIn Resolve / GoToResolve phishing)](https://news.sophos.com/en-us/)
- [KnowBe4 - RMM Tool Abuse as a Skeleton Key (GoTo Resolve / LogMeIn)](https://www.knowbe4.com/blog)
- [Huntress - Critical N-able N-central Vulnerability and Active Exploitation](https://www.huntress.com/blog/n-able-vulnerability-exploitation)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2645