Two RMMs walk into a phish… [Research Saturday]

CyberWire Daily

N2K Networks, Inc.

Daily News, Tech News, News, Technology

4.6 • 1K Ratings

🗓️ 22 November 2025

⏱️ 24 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

Alex Berninger, Senior Manager of Intelligence at Red Canary, and Mike Wylie, Director, Threat Hunting at Zscaler, join to discuss four phishing lures in campaigns dropping RMM tools. Red Canary and Zscaler uncovered phishing campaigns delivering legitimate remote monitoring and management (RMM) tools—like ITarian, PDQ, SimpleHelp, and Atera—to gain stealthy access to victim systems. Attackers used four main lures (fake browser updates, meeting invites, party invitations, and fake government forms) and often deployed multiple RMM tools in quick succession to establish persistent access and deliver additional malware. The report highlights detection opportunities, provides indicators of compromise, and stresses the importance of monitoring authorized RMM usage, scrutinizing trusted services like Cloudflare R2, and enforcing strict network and endpoint controls. The research can be found here: You’re invited: Four phishing lures in campaigns dropping RMM tools Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript

Click on a timestamp to play from that location

0:00.0	You're listening to the Cyberwire Network, powered by N2K.
0:09.7	From fishing to ransomware, cyber threats are constant, but with Nordlayer, your defense can be too.
0:21.4	Nordlayer brings together secure access and advanced threat protection in a single, seamless
0:26.3	platform.
0:27.4	It helps your team spot suspicious activity before it becomes a problem, by blocking malicious
0:32.5	links and scanning downloads in real time, preventing malware from reaching your network.
0:37.9	It's quick to deploy, easy to scale, and built on zero-trust principles, so only the right
0:43.3	people get access to the right resources.
0:46.2	Get 28% off on a yearly plan at Nordlayer.com slash Cyberwire Daily with code Cyberwire-28. That's Nordlayer.com slash Cyberwire Daily with code Cyberwire-28.
0:55.2	That's Nordlayer.com slash Cyberwire Daily, code Cyberwire-28.
1:01.2	That's valid through December 10, 2025.
1:03.8	Thank you. Hello, everyone and welcome to the CyberWires Research Saturday.
1:20.0	I'm Dave Bittner, and this is our weekly conversation with researchers and analysts
1:25.1	tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in a rapidly evolving cyberspace.
1:33.3	Thanks for joining us.
1:39.3	So remote monitoring and management tools basically allow remote users to access and administer devices with ease.
1:48.0	So they can be used by internal IT operations daily.
1:52.0	So they're used for things like applying updates, managing assets, deploying software, things like that.
1:59.0	The biggest issue here is that because they have all of these features,
2:02.6	they're also leveraged by adversaries,
2:04.6	and it really allows adversaries to blend in or even impersonate
2:09.6	an organization's IT or a vendor,
	...

Transcript will be available on the free plan in 1 days. Upgrade to see the full transcript now.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.