Phishing Campaign Uses Legitimate RMM Software for Persistent Remote Access
Patch: Enable MFA on all RMM accounts, review access logs, isolate compromised hosts, update RMM software, and notify users of phishing.
Patch: Enable MFA on all RMM accounts, review access logs, isolate compromised hosts, update RMM software, and notify users of phishing.
Summary
An active phishing campaign, codenamed VENOMOUS#HELPER, has been observed targeting multiple vectors since at least April 2025. The attackers use legitimate Remote Monitoring and Management (RMM) software as a foothold to establish persistent remote access on compromised hosts. Over 80 organizations, most of which are based in the United States, have been impacted according to Securonix. Attackers deliver malicious content via phishing emails that lure users into installing the compromised RMM client, which then provides a backdoor for lateral movement. The persistence mechanism relies on the RMM software’s native remote‑control capabilities, allowing attackers to maintain long‑term access even after initial compromise is detected.
The use of legitimate RMM tools masks the malicious activity, making detection harder for security teams. Immediate mitigation requires tightening RMM account security, monitoring for anomalous activity, and educating users on phishing indicators.
Key changes
- Phishing campaign codenamed VENOMOUS#HELPER launched in April 2025.
- Targets multiple vectors using legitimate RMM software for persistence.
- Over 80 U.S. organizations impacted per Securonix.
- Attackers deliver malicious content via phishing emails that prompt RMM client installation.
- Compromised RMM client provides a backdoor for lateral movement.
- Persistence relies on RMM’s native remote‑control capabilities.
- Attackers maintain long‑term access even after initial detection.
- Detection is harder due to legitimate RMM tool usage.