Remote Access Tool Abuse: How Attackers Hide Inside Your Own IT Software

Attackers no longer need to smuggle malware past your defenses. They’re using the software your IT team deliberately installed — AnyDesk, ScreenConnect, TeamViewer, Splashtop — and sitting quietly inside your environment for weeks or months before anyone notices. The FBI and CISA have both published significant advisories in the past 18 months confirming that this kind of intrusion via legitimate tools is accelerating, with businesses under 100 employees squarely in the crosshairs.

What Remote Access Tool Abuse Actually Means

There are two distinct scenarios here. In the first, an attacker tricks an employee into installing a remote access tool — typically through a phishing email or a fake tech-support pop-up. In the second, and far more dangerous scenario, the attacker finds a legitimate remote access tool already installed by the company’s own IT team and simply uses it for their own purposes after obtaining valid credentials or exploiting a software vulnerability.

That second scenario is what’s driving current advisory language around remote access tool abuse. The attacker isn’t introducing foreign software. They’re inheriting access through trusted, signed, IT-approved applications. Because the software itself is legitimate, most antivirus and endpoint security products treat the traffic as normal. That’s the core of why this technique works — and why it has become the preferred persistence method for ransomware groups, state-affiliated actors, and financially motivated criminal organizations alike.

This falls into a broader category security researchers call “living off the land” — using tools already present in the environment to avoid detection. Remote access software is the most powerful living-off-the-land asset available: it provides interactive, authenticated, full-screen access to a machine with minimal logging and often no alerting by default.

What 2024 and 2025 CISA and FBI Advisories Actually Say

The public advisory record on threats involving legitimate remote access software is extensive and still growing. Here’s what the documented guidance actually contains.

In January 2024, CISA and the FBI issued a joint advisory warning that threat actors — specifically those impersonating technical support staff — were using legitimate remote access software to gain persistent footholds in victim networks. The advisory noted the tactic had been observed across multiple critical infrastructure sectors, and that the software being weaponized was already present on target machines. The full advisory is available from CISA’s cybersecurity advisories page.

In mid-2024, CISA’s Known Exploited Vulnerabilities catalog added entries for vulnerabilities in ScreenConnect (ConnectWise) and several other remote access platforms actively exploited in the wild. The ConnectWise ScreenConnect vulnerabilities disclosed in February 2024 — tracked as CVE-2024-1708 and CVE-2024-1709 — were rated critical and allowed unauthenticated remote code execution. CISA gave federal agencies 48 hours to patch. Most small businesses had no idea the software they were running could be weaponized in this way.

The FBI’s Internet Crime Complaint Center 2023 annual report, released in early 2024, documented over $12.5 billion in cybercrime losses — with business email compromise and tech support fraud (which frequently relies on misused remote access tools) among the top categories by financial loss. The 2024 report, released in spring 2025, showed continued escalation in incidents involving legitimate tool misuse.

In February 2025, CISA issued additional guidance under its “Secure by Design” initiative, specifically calling on remote access software vendors to implement stronger authentication, session logging, and anomaly detection by default. When CISA starts directing guidance at the software makers themselves, it signals how central the exploitation of these tools has become as an attack vector.

Living Off the Land: The Technique Behind Remote Access Tool Abuse

Living off the land describes the practice of using built-in or pre-approved tools in a target environment rather than dropping custom malware. Historically, that meant abusing Windows administrative utilities like PowerShell or remote desktop protocol. The evolution into commercial remote access software is a meaningful escalation, because those tools are:

• Signed by trusted vendors, so they pass code-integrity checks automatically
• Designed to bypass firewalls and communicate over standard encrypted web ports
• Often configured to start automatically at system boot — giving attackers persistence without any additional action on their part
• Rarely monitored with the same rigor as other outbound traffic, because IT teams know they installed them
• Capable of providing full interactive access, file transfer, and clipboard sharing — everything needed to move laterally, exfiltrate data, or deploy ransomware

The attacker’s goal at this stage is persistence, not immediate action. Security researchers at Mandiant, CrowdStrike, and Microsoft’s threat intelligence teams all published research in 2024 showing that the median dwell time — the gap between initial access and detection — for attacks leveraging legitimate tools is significantly longer than for attacks using custom malware. Longer dwell time means more data exfiltrated, more systems compromised, and higher ransom demands when the final stage arrives.

What makes this threat particularly relevant for small businesses is the authentication layer. Many companies use remote access tools with shared credentials, weak passwords, or multi-factor authentication turned off. An attacker who obtains one set of credentials — through phishing, a credential-stuffing attack, or a purchased dump on the dark web — can access the remote access panel and begin operating as though they were a legitimate administrator.

Why Small Businesses Under 100 Employees Are the Primary Target

There’s a persistent myth that attackers focus on large enterprises because the payouts are bigger. The data doesn’t support that when it comes to intrusions via legitimate IT tools. Small businesses are the primary target for several compounding reasons.

• Small businesses are far less likely to have anyone reviewing authentication logs or remote session activity
• Remote access tools at small businesses are frequently installed once and never audited again — credentials may not have been rotated in years
• Multi-factor authentication adoption among small businesses remains low despite years of industry guidance, according to multiple NIST Cybersecurity Framework publications and CISA reports
• Small businesses often share a single remote access account across multiple staff members or IT contractors, making it nearly impossible to distinguish a legitimate session from a malicious one
• Cyber insurance underwriters have raised premiums and added exclusions for small businesses — creating a financial incentive for attackers who expect lower breach-notification costs from smaller victims

The Verizon 2024 Data Breach Investigations Report found that small businesses (under 1,000 employees, with a significant concentration in the under-100 range) accounted for the majority of confirmed breaches in their dataset — not because they were targeted for individual value, but because volume and ease of access make them attractive as a class. Ransomware affiliate networks specifically train attackers to scan for exposed remote access tools as the primary initial-access method.

For any business where the owner or executive is personally accountable to clients, a board, or a regulatory body if something goes wrong, the risk of having poorly secured remote access software is a board-level conversation — not just an IT conversation.

Real-World Examples From Public Incident Reports

The following examples are drawn from publicly disclosed incidents and advisory documentation. No client or confidential information is referenced.

• In late 2023 and into 2024, the ransomware group known as Scattered Spider was documented using legitimate remote access tools to maintain persistence inside victim environments for extended periods before deploying ransomware. CISA and the FBI published a joint advisory in November 2023 specifically attributing this technique to the group.
• The ConnectWise ScreenConnect vulnerability disclosed in February 2024 was exploited within hours of public disclosure. Incident responders at multiple firms found evidence of attacker sessions initiated through the legitimate software interface — the initial exploit was used solely to create a new administrative account, after which the attacker operated entirely through normal software functions.
• CISA’s 2024 advisory on healthcare sector threats documented incidents where threat actors used AnyDesk and similar tools to access electronic health record systems at small medical practices. The tools had been installed by previous IT vendors and never removed after those contracts ended.
• The FBI’s 2024 Private Industry Notification on tech support fraud described a pattern where victim employees were socially engineered into granting remote access, after which the attacker installed a second, hidden remote access tool to maintain persistence even if the original session was terminated.
• A separate CISA advisory from early 2025 on threats to water and wastewater systems described attackers accessing operational technology environments through remote access tools installed for legitimate vendor maintenance — software that had not been updated or audited in some cases for several years.

A Practical Defense Posture Against Remote Access Tool Abuse

This threat is serious. It is also defensible. The required defense posture isn’t exotic — it’s disciplined, consistent, and demands organizational commitment more than expensive technology.

Audit and inventory every remote access tool in your environment. Most organizations can’t accurately name all the remote access software installed across their endpoints. Start there. Any tool not actively managed by your current IT team and not actively needed for business operations should be removed immediately.

Enforce multi-factor authentication on every remote access tool, without exception. CISA has stated explicitly that multi-factor authentication is the single most effective control against credential-based intrusion via remote access software. There is no reasonable business justification for disabling it on software that provides full interactive access to your systems.

Implement session logging and alerting. Every remote access session should generate a log entry. Your IT team should receive an alert for any session initiated outside normal business hours or from an unrecognized geographic location. Most enterprise-grade remote access platforms support this — but the feature must be deliberately configured. It won’t be on by default.

Rotate credentials when vendor or contractor relationships end. If a previous IT firm, a former employee, or a vendor used a remote access tool to work in your environment, those credentials need to change the moment the relationship ends. This is a basic hygiene step that is routinely skipped and a leading enabler of unauthorized access through legitimate tools.

Establish a baseline of what normal remote access looks like. Your IT firm should be able to tell you who accessed your systems remotely, when, from where, and for how long. If they can’t answer those questions, the visibility needed to detect intrusions doesn’t exist.

Apply software updates within 48 hours of critical patch releases. The ConnectWise incident proved that critical vulnerabilities in remote access software are exploited within hours of disclosure. A patch process that takes weeks is not sufficient for this category of software.

An environment built around these controls doesn’t need an IT team on-site to be secure. The goal is an environment where telemetry is rich enough and controls are tight enough that anomalies surface immediately — not after a ransomware note appears on a Monday morning. See how our cybersecurity services are built around exactly this threat model, and how our managed IT services keep remote access environments continuously monitored and audited.

What to Ask Your IT Firm Right Now

If you manage or own a business under 100 employees and rely on an IT firm or an internal IT person, the following questions will quickly reveal whether your exposure to unauthorized access via remote tools is being actively managed. A competent IT team should be able to answer all of them without hesitation.

• Can you provide a current inventory of every remote access tool installed on our endpoints and servers, and tell me when each was last audited?
• Is multi-factor authentication enabled on every remote access tool in our environment, and can you show me the configuration?
• Do we generate session logs for every remote access connection, and does anyone review those logs or receive alerts for anomalous activity?
• When did we last rotate the credentials used for remote access, and do former vendors or contractors still have access?
• How quickly are we patching critical vulnerabilities in remote access software specifically — and how would you handle a disclosure like the February 2024 ConnectWise event if it happened today?
• If a threat actor had been using our remote access software for the past 30 days, what would have alerted you — and how confident are you in that detection capability?

That last question is the most revealing. The answer tells you whether your IT firm is running a reactive support model or a genuine security posture — and whether the risk of remote access tool abuse is something they’re actively guarding against or simply hoping never happens. There’s a meaningful difference between a firm that keeps your computers running and one that treats remote access as an attack surface to be monitored continuously. Cybersecurity-focused IT management assumes an attempt will happen and has the controls in place before the attacker arrives.

The threat actors exploiting remote access tools are patient, methodical, and well-resourced. The organizations that survive them aren’t necessarily the ones with the biggest budgets. They’re the ones whose IT environments were built with the assumption that an attempt was coming — and whose controls were configured long before it arrived.

If you’re not certain your environment meets that standard, Book a Free Cybersecurity Strategy Call. In 20 minutes, we’ll tell you exactly where your remote access exposure stands — no pressure, no obligation.