5 minhigh
The Rogue RMM Stack: One Phish, Multiple Persistence Paths
Attackers phish employees into installing rogue RMM clients (ITarian, ScreenConnect) with SYSTEM privileges, stacking multiple tools for redundant persistent access through legitimate IT workflows. Three Huntress SOC investigations reveal a pattern of phishing-driven rogue RMM installation. A TransferXL-hosted PDF lure delivered ITarian followed by ScreenConnect; two other incidents used Adobe InDesign-hosted lure pages to deploy multiple rogue ScreenConnect clients. Both RMM tools were installed with SYSTEM-level privileges, and the attacker ran HideUL_x64.exe for defense evasion.
Sens:■ ImmediateConf:
IOCs3
2url1filename
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Inventory all RMM tools across endpoints and remove unapproved installations
- Block identified phishing URLs at email gateway and web proxy
- Isolate hosts with multiple RMM clients and investigate for HideUL_x64.exe
- Hunt for RMM service installations originating from browser or PDF reader processes
Key Takeaways
- 277% spike in RMM abuse in 2025; seen in ~40% of Huntress incidents
- Attackers stack 2+ rogue RMM clients for redundant persistent access paths
- HideUL_x64.exe used as defense evasion binary during ScreenConnect sessions
- One rogue ScreenConnect client persisted undetected for five months before reuse
- Adobe InDesign Publish Online abused as legitimate hosting for phishing lure pages
Attack Chain
- Initial Access: Phishing email delivers lure via TransferXL download or Adobe InDesign-hosted page
- Execution: Victim extracts ZIP, opens PDF, or clicks "View Document" triggering RMM installer download
- Persistence: First rogue RMM client (ITarian or ScreenConnect) installed with SYSTEM-level privileges
- Defense Evasion: HideUL_x64.exe executed to hide subsequent attacker activity
- Persistence: Second rogue RMM client installed for redundant persistent access path
Affected Systems
- Windows endpoints with RMM client software
- Users targeted via phishing email lures
- Organizations using ITarian or ScreenConnect RMM tools
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | RMM processes look like normal IT activity; HideUL_x64.exe and unusual install ancestry are visible. |
| Network Visibility | Medium | Connections to TransferXL and Adobe InDesign appear legitimate; C2 infrastructure after redirect is key. |
| Detection Difficulty | Hard | RMM tools are legitimate software; distinguishing approved from rogue installs requires inventory baseline and install context. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| RMM installer processes executing from user temp or browser-spawned process ancestry without IT deployment tooling (T1218, T1204.002) | Process creation with parent-child relationships | Execution | Medium — IT staff may manually install RMM tools outside deployment tools |
| Multiple distinct RMM clients installed on same host within short timeframe indicating stacking for redundant access (T1543.002) | Service creation and software installation events | Persistence | Low — multiple RMM clients on one host is atypical |
| Execution of HideUL_x64.exe or similarly named defense evasion binaries during active RMM sessions (T1562) | Process execution within RMM session context | Defense Evasion | Low — HideUL_x64.exe is not a standard administrative tool |
| New RMM service installations initiated from browser or PDF reader process chains rather than IT deployment systems (T1543.002) | Service creation with parent process context | Persistence | Medium — some legitimate RMM installs may originate from browser downloads |
Required Log Sources
- Process execution logs with parent-child ancestry
- Windows service creation logs (Event ID 7045)
- Email gateway URL rewriting logs
- Web proxy logs
- RMM software installation logs
- File creation logs in user temp directories
Key Behavioral Indicators
- RMM installer launched from browser or PDF reader process ancestry
- Multiple distinct RMM clients present on single host
- SYSTEM-level service creation for RMM tools outside IT deployment windows
- HideUL_x64.exe process execution during RMM sessions
- RMM sessions originating from non-IT administrative user accounts
- New RMM installations not matching approved software inventory
Control Gaps
- Application allowlisting for RMM installer execution
- RMM software inventory baseline to detect rogue installations
- Monitoring for unsanctioned software installations outside change management
- Blocking executable launches from PDF reader and browser processes
False Positive Assessment
Medium — RMM tools are legitimate software used by IT teams; distinguishing approved from rogue installs requires inventory baseline and installation context.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement application allowlisting for all RMM software
- Block unsanctioned RMM tool network traffic at egress points
- Alert on new RMM service installations outside change management windows
- Restrict browser and PDF reader ability to spawn executable installers
User Protection
- Deploy endpoint detection that flags rogue RMM installations
- Block executable launches from PDF reader and browser processes
- Alert on RMM installer execution from user-context processes
Security Awareness
- Train employees to verify unexpected document share links before clicking
- Instruct users to report unexpected software installation prompts
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Command and Control
Showing defanged values
- filenameHideUL_x64.exeDefense evasion binary executed during ScreenConnect session
- urlhxxps://indd[.]adobe[.]com/view/c12ae62c-61c2-422b-894a-4a562efa3227Adobe InDesign lure page impersonating document share for phishing
- urlhxxps://transferxl[.]com/download/00jnskFCq9wtdD?utm_source=downloadmail&utm_medium=e-mailTransferXL download link hosting malicious PDF with embedded RMM installer