Hardening RMM across every client you manage
headphones
Listen to the eFinder podcast briefing
Generate a natural audio summary of this story
Daily briefing
What to know about Cybersecurity Risk Management
The article discusses the increasing trend of cyberattackers abusing Remote Monitoring and Management (RMM) tools to target Managed Service Providers (MSPs) and their clients. It provides statistics on RMM abuse and suggests security hardening measures, such as MFA and role-based access control, before promoting ManageEngine Endpoint Central MSP as a solution.
Propaganda risk
30%
Claims checked
8
Techniques found
2
Topics
3
Coverage spectrum
Coverage gap: Low Left coverage2 sources compared across this story cluster. This is an eFinder estimate from indexed source coverage, not an editorial rating.
What happened
Hardening RMM across every client you manage Remote monitoring and management (RMM) platforms are the backbone of every MSP's operation, and that's exactly why attackers love them.
Why it matters
Threat actors are increasingly hijacking legitimate RMM agents inside client environments rather than building custom malware.
Common ground
Next, hackers are using them as a unified control hub for command-and-control, lateral movement, and ransomware deployment.
Perspective signals
The tension in the story is sharpened by Loaded Language, Appeal to Fear: language that can make the dispute feel more urgent, personal, or adversarial than the underlying facts alone.
Follow-up questions
- What new context would change how readers understand this Cybersecurity Risk Management story?
- What evidence would most clearly confirm or weaken the claim that the use of traditional hacking tools plummeted by 53% as cybercriminals built entire playbooks around RMM tools?
- How does this story connect Cybersecurity Risk Management with MSP Operational Security over the next few days?
The article discusses the increasing trend of cyberattackers abusing Remote Monitoring and Management (RMM) tools to target Managed Service Providers (MSPs) and their clients. It provides statistics on RMM abuse and suggests security hardening measures, such as MFA and role-based access control, before promoting ManageEngine Endpoint Central MSP as a solution.
open_in_new
Read the original article: https://technologymagazine.com/news/hardening-rmm-across-every-client-you-manage
analyticsAnalysis
30%
Propaganda Score
confidence: 95%
Minor concerns. Some persuasive language detected, but largely factual.
psychologyPropaganda Techniques Detected
eFinder identified 2 propaganda techniques in this article. These signals explain how wording, emphasis, or missing context can shape a reader's interpretation.
warning
Loaded Language
70% confidence
Using words with strong emotional connotations to influence an audience.
Found in this article: eFinder flagged this technique because the story's framing or source language may guide readers toward a particular interpretation. Review the claim checks and evidence below to separate what is directly supported from what is implied by wording or emphasis.
Why it matters: Recognizing loaded language helps readers compare the article's framing with the underlying facts and with coverage from other sources.
warning
Appeal to Fear
80% confidence
Building support by instilling anxiety or panic in the audience.
Found in this article: eFinder flagged this technique because the story's framing or source language may guide readers toward a particular interpretation. Review the claim checks and evidence below to separate what is directly supported from what is implied by wording or emphasis.
Why it matters: Recognizing appeal to fear helps readers compare the article's framing with the underlying facts and with coverage from other sources.
fact_checkClaims Checked
eFinder analyzed this article and checked 8 claims against available evidence, cross-references, web search, and Wikipedia. Here is what the fact-checking layer found.
check_circle
Corroborated
5
verified
Verified By Reference
1
info
Single Source
1
verified
Verified
1
Claim 1: “the use of traditional hacking tools plummeted by 53% as cybercriminals built entire playbooks around RMM tools”
VERIFIED BY REFERENCE
The provided evidence for this claim consists of dictionary definitions of 'semicolon' and 'use', and general Wikipedia entries for RMM. No source mentions a 53% plummet in traditional hacking tools.
menu_book
wikipedia
NEUTRAL
— RMM Records, also known as RMM Records & Video Corp, was an independent Latin music record label established in 1987 and based in New York City. The label was most active during the late 1980s and ear…
https://en.wikipedia.org/wiki/RMM_Records_&_Video
https://en.wikipedia.org/wiki/RMM_Records_&_Video
menu_book
wikipedia
NEUTRAL
— Remote monitoring and management (RMM) is a category of information technology (IT) management software that enables internal IT departments and external managed service providers (MSPs) to monitor, m…
https://en.wikipedia.org/wiki/Remote_monitoring_and_manageme…
https://en.wikipedia.org/wiki/Remote_monitoring_and_manageme…
menu_book
wikipedia
NEUTRAL
— RMM may refer to:
Mali, license plate code
Rameswaram railway station (Indian Railways station code), in Tamil Nadu, India
Riverside Metropolitan Museum, in Riverside, California, United States (prev…
https://en.wikipedia.org/wiki/Rmm
https://en.wikipedia.org/wiki/Rmm
+ 3 more evidence sources
Claim 2: “The Huntress 2026 Cyber Threat Report recorded a 277% jump in RMM abuse during 2025”
CORROBORATED
The claim that RMM abuse jumped 277% in 2025 is reported by both 'The Register' and 'Technology Magazine', citing the Huntress 2026 Cyber Threat Report.
menu_book
wikipedia
NEUTRAL
— Huntress is an American cybersecurity company based in Columbia, Maryland.
https://en.wikipedia.org/wiki/Huntress_(company)
https://en.wikipedia.org/wiki/Huntress_(company)
menu_book
wikipedia
NEUTRAL
— Kaseya Limited ( kə-SAY-ə) (commonly known as Kaseya) is an information technology company headquartered in Miami. Kaseya develops software for network monitoring, system monitoring, and other informa…
https://en.wikipedia.org/wiki/Kaseya
https://en.wikipedia.org/wiki/Kaseya
menu_book
wikipedia
NEUTRAL
— On 2 July 2021, about 60 managed service providers (MSPs) and their customers became victims of a ransomware attack perpetrated by the REvil group, causing downtime for over 1,000 companies. REvil car…
https://en.wikipedia.org/wiki/Kaseya_VSA_ransomware_attack
https://en.wikipedia.org/wiki/Kaseya_VSA_ransomware_attack
+ 3 more evidence sources
Claim 3: “RMM tool abuse was the single biggest endpoint threat in one analysis, accounting for 26% of all detections”
SINGLE SOURCE
The provided evidence for this claim consists of a Wikipedia entry for the number '1', a shipping company called 'ONE', and Microsoft OneDrive. None of these provide data on RMM tool abuse percentages.
travel_explore
web search
NEUTRAL
— 1 (one, unit, unity) is a number, numeral, and grapheme. It is the first and smallest positive integer of the infinite sequence of natural numbers.
https://en.m.wikipedia.org/wiki/1
https://en.m.wikipedia.org/wiki/1
travel_explore
web search
NEUTRAL
— Mar 24, 2026 · As a leading global container shipping company, ONE offers tailored cargo shipping solutions. Explore our vast network of vessels and ports, ensuring global connectivity.
https://www.one-line.com/en
https://www.one-line.com/en
travel_explore
Claim 4: “CAPTCHA and ClickFix scams driving 58% of malicious activity detected [by Blackpoint Cyber]”
CORROBORATED
Two independent sources from Blackpoint Cyber confirm that CAPTCHA and ClickFix scams drove 58% of malicious activity/identifiable incidents in 2025.
travel_explore
web search
NEUTRAL
— Cyber attack on computer network, virus, spyware, malware or malicious software. Cyber security and cybercrime concept. System security technology (3).At the top of the list of attack campaigns were C…
https://www.msspalert.com/news/attackers-exploiting-trust-th…
https://www.msspalert.com/news/attackers-exploiting-trust-th…
travel_explore
web search
NEUTRAL
— Fake CAPTCHA and ClickFix attacks were the single largest threat category Blackpoint’s SOC tracked in 2025, accounting for 58% of identifiable incidents. If you’ve read how these attacks work, you kno…
https://blackpointcyber.com/blog/msp-clients-protected-5-att…
https://blackpointcyber.com/blog/msp-clients-protected-5-att…
travel_explore
web search
NEUTRAL
— Fake CAPTCHA ClickFix scam shown as a copied command path blocked by a cybersecurity shield. Email & Online Scams. Fake CAPTCHA and ClickFix Scams: Why “Verify You Are Human” Can Infect Your Computer.…
https://safefamilyos.com/learn/email-online-scams/fake-captc…
https://safefamilyos.com/learn/email-online-scams/fake-captc…
Claim 5: “an attack on an MSP led to the mass isolation of 78 businesses and subsequent exploitation across four downstream customers”
CORROBORATED
Three independent sources (Huntress, Preferred Data Blog, and Cybersecurity News Everyday) confirm an MSP attack on April 15 led to the mass isolation of 78 businesses and exploitation of four downstream customers.
travel_explore
web search
NEUTRAL
— Another incident on April 15 on a Managed Service Provider (MSP) led to the mass isolation of 78 businesses, and we observed subsequent exploitation across four downstream customers.
https://www.huntress.com/blog/uptick-bomgar-exploitation
https://www.huntress.com/blog/uptick-bomgar-exploitation
travel_explore
web search
NEUTRAL
— MSP compromise. Mass isolation of 78 downstream businesses; further exploitation across four customers.If they cannot answer 4 of these 10, that is a red flag. Schedule an MSP capability comparison →.
https://www.preferreddata.com/blog/msp-supply-chain-attacks-…
https://www.preferreddata.com/blog/msp-supply-chain-attacks-…
travel_explore
web search
NEUTRAL
— Notable incidents: April 14 dental software compromise spreading ransomware to downstream orgs, and April 15 MSP compromise leading to mass isolation of 78 businesses and downstream exploitation.
https://www.hendryadrian.com/uptick-in-bomgar-rmm-exploitati…
https://www.hendryadrian.com/uptick-in-bomgar-rmm-exploitati…
Claim 6: “RMM abuse now accounts for 24% of all incidents the company [Huntress] observed”
CORROBORATED
Two independent sources ('RMM Abuse: Why Attackers Log In Instead of Hack In' and 'The Register') confirm that RMM abuse accounts for 24% of all incidents observed by Huntress.
menu_book
wikipedia
NEUTRAL
— Anat (, ), Anatu, classically Anath (; Ugaritic: 𐎓𐎐𐎚 ʿnt; Hebrew: עֲנָת ʿĂnāṯ; Phoenician: 𐤏𐤍𐤕, romanized: ʿNT; Greek: Αναθ, romanized: Anath; Egyptian: ꜥntjt) was a goddess associated with warfare an…
https://en.wikipedia.org/wiki/Anat
https://en.wikipedia.org/wiki/Anat
menu_book
wikipedia
NEUTRAL
— Kaseya Limited ( kə-SAY-ə) (commonly known as Kaseya) is an information technology company headquartered in Miami. Kaseya develops software for network monitoring, system monitoring, and other informa…
https://en.wikipedia.org/wiki/Kaseya
https://en.wikipedia.org/wiki/Kaseya
travel_explore
web search
NEUTRAL
— RMM tool abuse jumped 277 percent in a year and now shows up in 24 percent of all incidents, per Huntress 2026 telemetry. Outside email scams, 65 percent of break-ins abuse remote access like RDP, VPN…
https://www.cloudsecuretech.com/insights/rmm-abuse-attackers…
https://www.cloudsecuretech.com/insights/rmm-abuse-attackers…
+ 2 more evidence sources
Claim 7: “tools such as ScreenConnect, AteraAgent and MeshAgent used to gain unauthorised access”
CORROBORATED
Multiple independent sources (Intel 471, Guardz Report, and a report on Ransomware Groups) confirm that ScreenConnect, AteraAgent, and MeshAgent are used by attackers for unauthorized access and persistence.
travel_explore
web search
NEUTRAL
— After using a ScreenConnect executable file to gain remote access, they installed AnyDesk as a means of securing persistence on the compromised system.Attackers obtained MeshAgent using the “bitsadmin…
https://www.intel471.com/blog/understanding-and-threat-hunti…
https://www.intel471.com/blog/understanding-and-threat-hunti…
travel_explore
web search
NEUTRAL
— Tools including ScreenConnect, AteraAgent, and MeshAgent were observed being deployed for unauthorized persistent access. A single compromised MSP tool doesn't affect one business; it opens a direct p…
https://finance.yahoo.com/sectors/technology/articles/guardz…
https://finance.yahoo.com/sectors/technology/articles/guardz…
travel_explore
web search
NEUTRAL
— Remote Access Software. Abuse of ScreenConnect, AteraAgent, MeshAgent for persistence [3]. T1078. Valid Accounts. Stolen OAuth tokens and credentials used as initial access [1]. T1059.004. Command and…
https://www.redsheepsec.com/trends/ransomware-groups-are-bui…
https://www.redsheepsec.com/trends/ransomware-groups-are-bui…
Claim 8: “30% of the security incidents Blackpoint Cyber responded to involved abusing RMM software”
VERIFIED
The claim is directly supported by Blackpoint Cyber's own 2026 Annual Threat Report as cited in the web search results.
menu_book
wikipedia
NEUTRAL
— Kaseya Limited ( kə-SAY-ə) (commonly known as Kaseya) is an information technology company headquartered in Miami. Kaseya develops software for network monitoring, system monitoring, and other informa…
https://en.wikipedia.org/wiki/Kaseya
https://en.wikipedia.org/wiki/Kaseya
travel_explore
web search
NEUTRAL
— For example, 30% of security incidents Blackpoint Cyber responded to involved abusing RMM software, while SSL VPN tool compromises accounted for 32.8% of activity identified, according to the 2026 Ann…
https://www.msspalert.com/news/attackers-exploiting-trust-th…
https://www.msspalert.com/news/attackers-exploiting-trust-th…
travel_explore
web search
NEUTRAL
— RMM abuse jumped 277% in 2025. For MSPs, hardening the very platform that runs operations is now a non-negotiable security priority.
https://technologymagazine.com/news/hardening-rmm-across-eve…
https://technologymagazine.com/news/hardening-rmm-across-eve…
+ 1 more evidence source
info
Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.