Your Malware Infection is Just Three RMMs in a Trenchcoat

Building custom malware is difficult and expensive. Buying a cheap license for a legitimate Remote Monitoring and Management (RMM) tool with a valid digital certificate is effortless. Threat actors have shifted away from traditional malware families, turning commercial remote access software into their initial access vehicle of choice.

In this session, Andrew "Spike" Brant (Principal Threat Intelligence Incident Commander at Huntress) pulls back the curtain on real-world honeypot findings and incident response discoveries. Spike breaks down the bizarre anatomy of modern attacks—including a mind-bending incident where threat actors stacked multiple RMMs on top of each other using Bring Your Own Vulnerable Driver (BYOVD) exploits and fake "Windows Update" screen-blanking tricks to stay hidden while operating live on a compromised machine.

What You'll Learn:

• The RMM Threat Shift: Why commercial remote access tools (FleetDeck, Splashtop, Tyflux) are fast replacing traditional malware as the dominant payload.

• Anatomy of a Multi-Stage Attack: How threat actors leverage social engineering, legacy drivers, and layered backup RMMs to ensure persistent network access.

• Practical Defense Guidelines: Actionable strategies for auditing your environment's software inventory, implementing strict allowlisting, and identifying rogue IT tools before they turn into ransomware gateways.