--- title: Cyber criminals use legitimate IT RMM tools to control computers description: Remote Management and Monitoring (RMM) are commonly used by IT professionals to remotely access and manage computers. However, cyber criminals have found ways to exploit these tools, using them to gain access to a computer to install malware and discover and exfiltrate data.  image: https://blog.ballastservices.com/hubfs/Close-up%20dark%20keyboard%20with%20coding%20and%20programing%20concept-1.jpeg --- [![](https://blog.ballastservices.com/hubfs/raw_assets/public/ballast-website-theme/images/logos/logo_header.svg)](http://ballastservices.com) Services [About Us](https://23611281.hs-sites.com/about-ballast) [Insights](https://blog.ballastservices.com/it-insights) - [Cybersecurity Services](https://23611281.hs-sites.com/services/cybersecurity) - [Advisory Services](https://23611281.hs-sites.com/services/advisory-services) - [Professional Services](https://23611281.hs-sites.com/services/professional-services) - [Secure Managed Services](https://23611281.hs-sites.com/services/secure-managed-services) Risk Assessments + Penetration Testing + SOC Services + Threat Detection & Response + EDR + MDR + Vulnerability Management + Privileged Account Protection + Security Awareness Training Trusted Executive Advisors + Executive Partnership CIO/CISO + Merger + Acquisition  Flexible + Cost-Effective Project Services + Essential IT Design & Engineering + Cutting-Edge Automated Tools  + Stabilize, Optimize & Secure IT. Monitor + Secure IT + Improve IT + Expert Support [Get In Touch](http://ballastservices.com/contact-us) Menu + - Services - [Cybersecurity Services](https://23611281.hs-sites.com/services/cybersecurity) - [Advisory Services](https://23611281.hs-sites.com/services/advisory-services) - [Professional Services](https://23611281.hs-sites.com/services/professional-services) - [Secure Managed Services](https://23611281.hs-sites.com/services/secure-managed-services) - [About Us](https://23611281.hs-sites.com/about-ballast) - [Insights](https://blog.ballastservices.com/it-insights) [Get In Touch](http://ballastservices.com/contact-us) # Cyber criminals use legitimate IT RMM tools to control computers [Ballast Services](https://blog.ballastservices.com/it-insights/author/ballast-services) Jan 26, 2023 5:00:00 PM ![Close-up dark keyboard with coding and programing concept-1](https://blog.ballastservices.com/hs-fs/hubfs/Close-up%20dark%20keyboard%20with%20coding%20and%20programing%20concept-1.jpeg?width=1000&height=667&name=Close-up%20dark%20keyboard%20with%20coding%20and%20programing%20concept-1.jpeg)Cybercriminals are constantly finding new and innovative ways to gain access to individuals' and organizations' computers and steal sensitive information. [ZDnet repo](https://www.zdnet.com/article/nsa-and-cisa-alert-this-phishing-scam-could-give-hackers-control-of-your-pc/?ftag=TRE-03-10aaa6b&utm_email=809f41486e27e64342b428d621003cf1ad70198f14b3365cc9b2f7565021b592&utm_campaign_id=6021274&utm_email_id=4af5e21e455c0f2ba3997da128743b3aee305a60649952a7e28d36f2189a4fae&utm_newsletter_id=92303&medium=email&source=iterable)[rts](https://www.zdnet.com/article/nsa-and-cisa-alert-this-phishing-scam-could-give-hackers-control-of-your-pc/?ftag=TRE-03-10aaa6b&utm_email=809f41486e27e64342b428d621003cf1ad70198f14b3365cc9b2f7565021b592&utm_campaign_id=6021274&utm_email_id=4af5e21e455c0f2ba3997da128743b3aee305a60649952a7e28d36f2189a4fae&utm_newsletter_id=92303&medium=email&source=iterable) that one tactic that has become increasingly popular is the use of legitimate IT tools to gain control of computers. [The United States Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert](https://www.cisa.gov/uscert/ncas/current-activity/2023/01/25/cisa-nsa-and-ms-isac-release-advisory-malicious-use-rmm-software) due to the rising use of commercial Remote Monitoring and Management software for malicious use, such as ransomware installation.   Remote Management and Monitoring (RMM) are commonly used by IT professionals to remotely access and manage computers. However, cybercriminals have found ways to exploit these tools, using them to gain access to a computer to install malware and discover and exfiltrate data.  Cybercriminals use these legitimate IT tools by gaining access to a user's login credentials through phishing scams. They will send an email or message that appears to be from a legitimate source, such as a company IT department, asking the user to enter their login information. Once the cybercriminal has access to the login credentials, they can use RMM software to remotely access the computer.  Another tactic that cyber-criminals use is to install “dropper” malware on a computer that allows them to gain remote access, often using phishing or unpatched vulnerabilities which allow for remote code execution on the endpoint. Once the malware is installed, the cyber-criminal can then deploy RMM software to connect to the infected computer and control the computer, change configurations, install additional malware, and steal sensitive information without users being aware of the changes.  To protect against these types of attacks, it is important to be vigilant when receiving emails or messages that ask for login information and to be sure to only use legitimate IT tools from reputable sources. Additionally, keeping anti-virus or EDR software up-to-date and regularly scanning for malware can help protect against these types of attacks. Take steps to protect against these types of attacks by being cautious when receiving emails or messages asking for login information. Email security solutions, Managed EDR and User Awareness Training are ways an organization can protect against attacks using IT tools, as these attacks typically require user information or permission to be successful.  Modernize, Optimize, Stabilize, and Secure your organization today. Contact us at 813-568-9011, visit our website at [https://ballastservices.com](https://ballastservices.com/), or click on Get In Touch to speak with us today.   [Secure Managed Services](https://blog.ballastservices.com/it-insights/tag/secure-managed-services), [News](https://blog.ballastservices.com/it-insights/tag/news) ## Read On [![](https://blog.ballastservices.com/hs-fs/hubfs/Security%20concept%20Lock%20on%20digital%20screen%2c%20illustration.jpeg?width=352&name=Security%20concept%20Lock%20on%20digital%20screen%2c%20illustration.jpeg)](https://blog.ballastservices.com/it-insights/why-privileged-account-management-is-key-to-your-businesses-security) ### [Why Privileged Account Management Is Key to Your Business Security](https://blog.ballastservices.com/it-insights/why-privileged-account-management-is-key-to-your-businesses-security) Businesses rely heavily on technology to operate and store sensitive information. As a result, the... [![](https://blog.ballastservices.com/hs-fs/hubfs/Technician%20walking%20in%20hallway%20of%20server%20room.jpeg?width=352&name=Technician%20walking%20in%20hallway%20of%20server%20room.jpeg)](https://blog.ballastservices.com/it-insights/server-patch-management-best-practices) ### [Server Patch Management Best Practices](https://blog.ballastservices.com/it-insights/server-patch-management-best-practices) Businesses are increasingly dependent on technology to enable their operations, and the security... [![](https://blog.ballastservices.com/hs-fs/hubfs/shutterstock_2003834435.jpg?width=352&name=shutterstock_2003834435.jpg)](https://blog.ballastservices.com/it-insights/why-you-need-a-patch-management-program-asap) ### [Why You Need a Patch Management Program ASAP](https://blog.ballastservices.com/it-insights/why-you-need-a-patch-management-program-asap) Along with phishing, unpatched vulnerabilities are the most common way cybercriminals gain access... Back to Top [Get In Touch](http://ballastservices.com/contact-us) - [Cybersecurity Services](https://23611281.hs-sites.com/services/cybersecurity) - [Advisory Services](https://23611281.hs-sites.com/services/advisory-services) - [Professional Services](https://23611281.hs-sites.com/services/professional-services) - [Secure Managed Services](https://23611281.hs-sites.com/services/secure-managed-services) - [About Us](https://23611281.hs-sites.com/about-ballast) - [Insights](https://blog.ballastservices.com/it-insights) (888) 450-4322 | 3689 Tampa Rd Suite 340, Oldsmar, FL 34677 Copyright © 2023 Ballast Services Inc. All Rights Reserved.  [Privacy Policy.](https://23611281.hs-sites.com/privacy-policy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Ballast Services", "url" : "https://blog.ballastservices.com/it-insights/author/ballast-services" }, "dateModified" : "2023-02-22T14:27:00.327Z", "datePublished" : "2023-01-26T22:00:00.000Z", "headline" : "Cyber criminals use legitimate IT RMM tools to control computers", "image" : [ "https://blog.ballastservices.com/hubfs/Close-up%20dark%20keyboard%20with%20coding%20and%20programing%20concept-1.jpeg" ], "mainEntityOfPage" : { "@id" : "https://blog.ballastservices.com/it-insights/cyber-criminals-use-legitimate-it-rmm-tools-to-control-computers", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.ballastservices.com/hubfs/ballast-tagline-blue-1.png" }, "name" : "Ballast Services" } } ```