--- title: RMM Abuse Explodes as Hackers Ditch Malware | daily.dev description: Huntress's 2026 Cyber Threat Report reveals a 277% year-over-year surge in abuse of remote monitoring and management (RMM) tools like ScreenConnect, AnyDesk,... canonical: https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: RMM Abuse Explodes as Hackers Ditch Malware | daily.dev og:description: Huntress's 2026 Cyber Threat Report reveals a 277% year-over-year surge in abuse of remote monitoring and management (RMM) tools like ScreenConnect, AnyDesk,... og:url: https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4 og:image: https://api.daily.dev/og/posts/v44L6TYt4.png og:image:alt: RMM Abuse Explodes as Hackers Ditch Malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # RMM Abuse Explodes as Hackers Ditch Malware **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Huntress's 2026 Cyber Threat Report reveals a 277% year-over-year surge in abuse of remote monitoring and management (RMM) tools like ScreenConnect, AnyDesk, and NetSupport. Threat actors are abandoning traditional malware in favor of these legitimate enterprise tools, which blend in with normal activity and provide stealth, persistence, and C2 capabilities. Traditional hacking tools dropped 53% while RMM abuse expanded across all industries, especially healthcare and tech. Attackers now use specific RMM products for targeted tasks—ScreenConnect for credential harvesting, NetSupport for staging, PDQ Connect for malware delivery. Mitigation requires tighter access controls, allowlisting, behavioral monitoring, and greater accountability from RMM vendors themselves. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [RMM Abuse: How Attackers Exploit Remote Access Tools](https://daily.dev/posts/rmm-abuse-how-attackers-exploit-remote-access-tools-kmwmtlqwz) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"RMM Abuse Explodes as Hackers Ditch Malware","url":"https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4"},"datePublished":"2026-02-23T22:51:30.907Z","dateModified":"2026-02-23T22:52:05.074Z","description":"Huntress's 2026 Cyber Threat Report reveals a 277% year-over-year surge in abuse of remote monitoring and management (RMM) tools like ScreenConnect, AnyDesk,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3fb04afe449ece3357c1445c07a46390?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3fb04afe449ece3357c1445c07a46390?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"RMM Abuse Explodes as Hackers Ditch Malware"}]} ```