MSP360 Abused in Dual-RMM Phishing to Deploy ScreenConnect

Introduction

In today’s digital landscape, threat actors continually refine their tactics to bypass traditional security controls. A recent alert from Microsoft highlights a sophisticated phishing campaign that leverages the widely‑trusted MSP360 Remote Monitoring and Management (RMM) software as a delivery vehicle. Victims receive emails that appear innocuous—meeting invitations, PDF attachments, or routine software update prompts—each containing an installer for MSP360 under a misleading file name. When the installer runs, it activates remote management capabilities, effectively handing attackers a foothold that can later be used to deploy secondary tools such as ScreenConnect. This dual‑RMM strategy not only evades detection but also deepens the attacker’s control over compromised environments.

The campaign underscores how attackers combine legitimate software with social‑engineering lures to exploit user trust. Understanding the full attack chain and implementing layered defenses are essential to mitigate the risk posed by these multi‑stage threats.

How Attackers Lure Victims

Phishing emails in this campaign are carefully crafted to appear legitimate, employing several common deception techniques:

• Meeting Invites: Attackers send calendar invitations that reference real projects or colleagues, embedding a malicious attachment that masquerades as the meeting agenda.
• PDF-themed lures: Recipients receive files labeled as PDFs, but the actual payload is a renamed MSP360 installer. The PDF icon is often mimicked, increasing the likelihood of execution.
• Software update prompts: Fake update notifications claim that the user’s remote monitoring tool needs an urgent patch, prompting them to download and run the installer.
• Other social‑engineering content: Generic messages referencing IT support tickets or system maintenance serve as additional cover.

Each of these vectors exploits the recipient’s expectation of routine, low‑risk interactions, making it difficult for standard email filters to distinguish malicious intent.

Technical Impact and Attack Chain

Once the MSP360 installer is executed, it performs the following actions:

• Establishes a remote management session under a deceptive file name, granting the attacker administrative-level access to the victim’s machine.
• Creates service accounts or scheduled tasks that ensure persistence across reboots.
• Opens a communication channel that can be leveraged for subsequent payloads, most notably ScreenConnect, a remote support tool often abused by cybercriminals.

The dual‑RMM approach is particularly insidious because MSP360 is a legitimate solution used by many organizations for monitoring and maintenance. Attackers can hide their activities within normal administrative traffic, making detection challenging. Moreover, the presence of two RMM platforms complicates incident response, as defenders must identify which tools are authorized and which have been compromised.

Microsoft’s advisory emphasizes that the attackers are not merely using MSP360 as a one‑time gateway; they intend to maintain long‑term access, exfiltrate data, and potentially move to other systems within the network.

Defensive Strategies

Organizations can adopt a multi‑layered defense to counter this threat:

• User Education: Conduct regular training sessions that highlight the subtleties of phishing lures, especially those involving trusted software.
• Email Filtering: Deploy advanced sandboxing and URL reputation services that can analyze attachments for unusual file signatures or known malicious behaviors.
• Application Control: Implement whitelisting or application control policies that restrict the execution of unknown installers, particularly those with generic or deceptive names.
• Least Privilege Principles: Limit user and service accounts to minimal rights, reducing the impact of a successful MSP360 compromise.
• Monitoring and Auditing: Enable logging for RMM platforms and set up alerts for anomalous remote sessions, such as connections from unusual IP ranges or atypical times.
• Endpoint Detection and Response (EDR): Utilize AI‑driven EDR solutions that can spot patterns associated with dual‑RMM deployments and automatically isolate suspicious endpoints.

By combining proactive user awareness with technical controls, enterprises can significantly lower the risk of falling victim to these deceptive campaigns.

Conclusion

The abuse of MSP360 in phishing campaigns serves as a stark reminder that even trusted software can become a vector for compromise when paired with sophisticated social engineering. By staying vigilant, educating staff, and implementing robust technical safeguards, businesses can protect themselves from these multi‑stage attacks. For those seeking a proactive partner to enhance detection and response capabilities, Grivyonx Cloud offers AI‑driven automation and comprehensive cybersecurity solutions designed to identify and neutralize threats like dual‑RMM phishing before they cause lasting damage.