How RMM abuse gives attackers a way in that looks like business as usual Huntress found attackers using legitimate remote monitoring and management (RMM) software in 45% of the endpoint-related incidents it recorded in the first quarter of 2026. The security company also ranked 11 attack tactics by how often it sees them and how much damage each can do, and RMM abuse sits farthest right on the chart, the position for tactics it sees most often. IT teams use RMM tools to manage computers from anywhere, so an attacker who installs one gets persistent access and remote command execution that looks like ordinary administrator work. Huntress calls the category one hop from ransomware or data theft and says it jumped 277% year over year in 2025. The malicious copy and the approved one can…