TGViewer
CTT Report Hub CTT Report Hub @aptreports · 3.5K subscribers
Post #32763 10
#ParsedReport #CompletenessLow
26-09-2026

The Rogue RMM Stack: One Phish, Multiple Persistence Paths

https://www.huntress.com/blog/rogue-rmm-abuse-phishing-persistent-access

Report completeness: Low

Threats:
Itarian_tool
Screenconnect_tool

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1105, T1204.001, T1204.002, T1219, T1566.002

IOCs:
File: 1
IP: 0
Domain: 0
Url: 0
Hash: 0
Email: 0
BrowserExtension: 0

Soft:
Microsoft 365

Algorithms:
zip
Huntress Rogue RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress The Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it.
More from @aptreports
  1. Sep 26, 2026#ParsedReport #ChatGPT #Translated Autotext: (TI Report Analyser + ChatGPT + Auto Translat…
  2. Sep 26, 2026#ParsedReport #GeneratedSchema Generated with GPT-4
  3. Sep 26, 2026#ParsedReport #CompletenessMedium 26-09-2026 Open-source AI repositoriesStealthy contamina…
  4. Sep 26, 2026#ParsedReport #ChatGPT #Translated Autotext: (TI Report Analyser + ChatGPT + Auto Translat…
  5. Sep 26, 2026#ParsedReport #GeneratedSchema Generated with GPT-4
  6. Sep 26, 2026#ParsedReport #CompletenessLow 26-09-2026 Storm-3168: Agentic-driven cloud attacks using c…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →