Executive Summary

The article reports a growing trend of threat actors abusing Remote Management and Monitoring (RMM) tools. It references prior use of ScreenConnect and announces discovery of another RMM tool being leveraged in attacks. The post is part of a series documenting RMM exploitation in the wild, sourced from the SANS Internet Storm Center.

---

Intelligence Metadata - Source Publisher: SANS Internet Storm Center - Published Date: 2026-10-06T13:16:02+00:00 - Category: threat-intel

Original Description: It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.

"Keep yourself to the sunshine and you cannot see the shadow."

— Helen Keller