According to the report, once executed, the legitimate MSP360 installer — distributed under a deceptive file name — established remote management access on the affected system. The campaign is notable for its dual-RMM approach: after gaining a foothold via MSP360, the attackers were observed deploying ScreenConnect as a second remote access tool.

Key points from the reporting:

• Attackers distribute a genuine, signed MSP360 RMM installer rather than custom malware, which can help evade detection.
• Lures include meeting invitations, PDF-themed content, and software update prompts.
• The installer is given a deceptive file name to appear benign.
• Successful execution grants remote management access to the victim machine.
• ScreenConnect is then deployed as an additional RMM tool, creating a dual-RMM foothold.

Because the tooling involved is legitimate software, defenders should focus on monitoring for unauthorized RMM installations, unusual remote-management traffic, and installer executions that do not match approved software deployment processes.

Source: The Hacker News

Has your organization seen unexpected RMM installers like MSP360 or ScreenConnect appearing outside of approved deployment channels?