Affected Systems
Organizations using Windows endpoints. Attackers distribute legitimate MSP360 RMM v2.5.0.67 installer via phishing emails with deceptive filenames (meeting invites, PDF readers, Zoom installers). ScreenConnect deployed as secondary RMM. Faronics Deploy Agent observed as alternative initial access vector in separate attacks.
Exploitation Status
Active exploitation confirmed. Microsoft detected campaigns in July 2026. No CVE assigned as legitimate software is being abused. Threat actor attribution unknown.
Business Impact
Attackers gain persistent remote administrative access to compromised Windows endpoints using trusted RMM tools, making detection difficult. Dual-RMM setup (MSP360 + ScreenConnect) provides redundant access channels and enables credential theft, reconnaissance, and lateral movement while blending into legitimate IT operations. Legitimate digital signatures on MSP360 installer bypass standard security controls.
Urgency
🟠Within 24 hours
Recommended Actions
- Block execution of MSP360 RMM v2.5.0.67 installer (RMM.Agent.exe, RMM.Agent.Launcher.exe) unless deployed through authorized IT channels; validate digital signatures against known-good hashes
- Monitor for unauthorized ScreenConnect and Faronics Deploy Agent installations; audit all RMM tool deployments and correlate with change management records
- Block inbound UDP traffic on port 48678 (MSP360) at host firewalls unless explicitly required; review Windows Firewall rule changes via Event ID 2004-2006
- Hunt for suspicious Registry autorun entries and Windows services created by RMM installers; inspect PowerShell execution logs (Event ID 4104) for ScreenConnect installation activity
- Implement email filtering rules to block executables with deceptive naming patterns (e.g., *_rmm_v2.5.0.67_*.exe, ZoomSetup*.exe, PDF*Reader*.exe) and scrutinize attachments from cloud storage links (S3, Dropbox, GitLab, Supabase, Cloudflare R2)