Executive summary
Remote monitoring and management (RMM) tools are widely used in modern IT operations, but they are increasingly exploited by cybercriminals. Acronis analyzed telemetry from over 1.8 million endpoints running Acronis RMM between January 2025 and March 2026 and found that 63% of endpoints have more than one remote access tool installed, with over a third running three or more simultaneously, increasing the attack surface and complicating IT infrastructure.
Attackers now routinely deploy legitimate or open-source RMM tools directly onto victim machines to blend in with normal traffic. Our investigation of RMM traffic, cross-referenced with incidents, finds that the most abused tools include open-source tools, or tools whose source code has leaked, such as MeshAgent, as well as common protocols and tools such as RDP and VNC / UltraVNC.
In this first blog, in a two-part series, we analyze the data to discover where RMM-associated risks lie. In part two of the series, which we will release in the coming weeks, we will provide recommendations for hardening and identifying and responding to RMM-associated threats.
The proliferation of RMM tools
RMM tools have become essential infrastructure for modern IT operations, especially for small and medium-sized businesses (SMBs) and managed service providers (MSPs). But the same features that make RMM tools so valuable to IT personnel also make them incredibly attractive to cybercriminals; in particular, ransomware groups.
The vulnerability surface across RMM and remote access tools remains active. In 2025, N-able RMM disclosed eight vulnerabilities, ConnectWise ScreenConnect added two more, and TeamViewer led remote access tools with 19 CVEs, including two critical. AnyDesk contributed another two. All RMM platform vulnerabilities disclosed in 2025 were rated high or critical. The tools MSPs rely on daily for endpoint management and remote support continue to draw scrutiny from both researchers and attackers. Beyond direct exploitation, many ransomware groups continue to rely heavily on RMM tools as part of their operations. In practice, this means that even legitimate administrative software can be turned into an attack vector. So, when attackers compromise RMM tools, they can quickly spread across multiple organizations simultaneously.
In this article, we analyze Acronis telemetry from over 1.8 million managed endpoints to answer three questions: What remote access tools are running in SMB environments? Which ones are being weaponized? And what can SMBs do about it?
The findings paint a broad picture of risk, challenges and solutions. The data shows that two thirds of managed endpoints have two or more remote access tools installed, indicating the growing complexity of IT environments, and the risks associated with it. The findings also indicate that attackers are increasingly deploying their own RMM tools onto victim machines in order to facilitate breaches, and the findings demonstrate which types of RMM software are most widely abused.
Based on this broad, data-driven picture of RMM-related risks, we offer recommendations for hardening and preventing attacks based on, and leveraging, RMM software.
Remote access tools across MSP environments
What EDR tells us about remote access tool usage
Our investigation focused on two data sets. First, we analyzed all EDR incidents from January 2025 through March 2026 where threat signatures referenced a remote access or RMM tool. These detections include both existing, legitimate tools abused by an attacker, and RMM tools deployed by attackers.
The second data set, application inventory data, reveals the full landscape of what's installed across managed endpoints. While EDR telemetry shows what triggers security events, to fully understand the current state of RMM abuse, we first need to take a look at the broader picture: which RMM software is legitimately used by IT teams, and how.
It’s important to keep in mind that across the entire dataset, all the endpoints have Acronis’ RMM and cyber protection products installed, potentially in addition to other RMMs.
The tool sprawl problem: The RMM and remote access inventory
Across nearly two million managed endpoints, all of which are running the Acronis RMM, only 36% are running a single RMM product, and 63.1% have at least two RMM or remote access tools installed, many of which have three, four and even five tools installed at once.
One RMM tool is a management necessity. Two or more is a security risk. A bit under two thirds of managed endpoints run two or more remote access tools simultaneously, and over 22% run three or more.
Why does this matter? Every additional remote access tool is another potential entry point. Each tool has its own authentication system, its own patch cycle and its own vulnerability surface. When AnyDesk's production systems were breached in February 2024 — with attackers stealing source code and private code signing certificates — every endpoint running AnyDesk was at elevated risk. In addition, many attackers use RMM software as part of their attack, like this September 2025 attack.
If a victim machine has RMM software installed (and presumably whitelisted), it can potentially be abused. If an endpoint has multiple remote access tools, like TeamViewer, ConnectWise and Splashtop installed, a defender will need to audit, patch and maintain multiple different tools instead of one.
Things get even more interesting when we look at individual RMM software vendors being used, and in what combinations. The RMM market across Acronis-managed environments splits into two categories: dedicated RMM platforms used by MSPs for day-to-day management, and standalone remote access tools used for ad-hoc support. Once more, keep in mind that the Acronis RMM is installed on 100% of machines analyzed, and therefore we are only showing products installed in addition to the Acronis product, to make the charts easier to read.
Top remote administration tools and protocols (current installations):
TeamViewer is present on over 16% of all monitored endpoints. Among the dedicated RMMs (aside from Acronis, that is present on all endpoints), ConnectWise ScreenConnect leads platforms at 9%.
RMM tools in action: What does usage data teach us about endpoints with multiple tools?
While it’s interesting to analyze the distribution of RMM and RAT installations across nearly two million devices, it also raises a complex issue: one of multiple RMM or RAT devices installed on the same machine.
The presence of multiple RMM tools on a single endpoint is rarely intentional by design, and instead reflects platform migrations, multiple service providers, different tools for different functions, or, in some cases, unauthorized tool deployment.
To better understand the scope of the problem, we decided to look at an entirely new dataset RMM usage. Up to this point, we’ve been examining application inventories, essentially, what is installed on each machine. In this section, we’ll be looking at RMM usage data, which can show us how tools are being used, and whether multiple tools are used together. If inventory data can teach us about the distribution of tools, usage data can help us figure out if they are being used, how often, or if they are simply installed and forgotten.
We analyzed the usage of various RMM tools across endpoints and categorized the various combinations of tools used alongside the Acronis RMM and other RMM platforms on endpoints. 30% of Acronis RMM endpoints use it as the sole tool, according to actual usage statistics — and although the two sets of data are not perfectly correlated, this seems to offer some similarity to the inventory figures from the previous section, which rely on what applications are installed, that show 36% of EPs with the Acronis RMM as the only RMM tool installed.
Common RMM tool combinations:
The remaining 70% paint a complex picture. While we’ve only included the top 10 use cases, this list continues with a long tail of other combinations and use cases. At the top, however, we see various combinations of tools used alongside the Acronis RMM, for various reasons. We see Acronis used alongside TeamViewer, a popular remote access tool, in 8% of devices, and Acronis RMM used alongside other RMMs, such as ConnectWise and NinjaOne in some instances as well.
Two patterns emerge. The first is the MSP's primary RMM platform alongside a general-purpose remote access tool: Acronis RMM usage alongside TeamViewer, AnyDesk and others. The RMM platform handles scheduled maintenance, patching, and monitoring. TeamViewer or AnyDesk gets used for ad-hoc support sessions with end users or was installed by a previous IT provider and never removed. Some of these tools may also have been installed by end users themselves for personal use. In particular, the latter can introduce a lot of risk if not managed well enough. As mentioned before, running two tools that can do the same thing is generally considered a bad thing. Most RMM software can provide the type of remote desktop connectivity that a remote access tool can provide. Maintaining an additional tool (or multiple tools in some cases) alongside your RMM can introduce security risks.
The second pattern involves multiple MSP platforms on the same endpoint: Acronis RMM + ConnectWise, ConnectWise + Datto. These typically appear during MSP transitions, when a customer is migrating from one provider to another, and the old agent was never uninstalled. However, in these cases, co-managed customers may have both their internal IT tools and their MSP’s tools running simultaneously. This pattern also expands the attack surface. Each additional tool brings its own authentication system, its own vulnerability history, and its own network connections. Worse, if an RMM software is installed (and whitelisted), but left unused, it can either be used by an attacker to hide malicious traffic. It is highly advisable to maintain the least amount of concurrent installation of any of these RMMs and remote access tools.
A third, notable pattern involves open-source or self-hosted tools — VNC, RustDesk and traces of MeshCentral and TacticalRMM. VNC ranks third overall, driven by its zero cost, pre-installation on Linux and macOS, and suitability for lightweight server-level access. RustDesk appeals to privacy-conscious or compliance-driven organizations seeking full control over their relay infrastructure. These tools coexist with Acronis RMM not from migration or overlap, but because they serve a fundamentally different access tier — low-level, agent-free and zero-cost. However, as we will see in the next section, the usage of open-source tools such as these can create risk, as these tools might also be used by attackers, and can blend in with legitimate traffic.
Maliciously managed: The growing abuse of RMM platforms in cyberattacks
Over the past two years, threat actors have shifted away from building custom command-and-control infrastructure. Instead, they install commercially available RMM tools on victim machines. An endpoint running an instance of MeshAgent that the IT team never deployed might look, from a network perspective, like any other managed device. Outbound traffic is encrypted, signed and directed at legitimate cloud infrastructure.
To understand the scope of this problem, we analyzed thousands of attacks involving RMM software. These are attacks where the attacker used a recognized remote management tool as part of the attack chain. The tool gave them the same capabilities an MSP technician would have: remote desktop, command execution, file transfer. The per-customer impact is also disproportionate. A single compromised MSP running ConnectWise ScreenConnect could generate hundreds of incidents across its client base in a matter of hours, as we've seen in real campaigns. This is possible because ScreenConnect lets one administrator control many computers at once, so a single breach can quickly affect multiple organizations.
These numbers exclude attacks that use RMM-like capabilities without triggering a tool-specific signature. An attacker who deploys a custom-compiled MeshAgent variant or a repackaged ScreenConnect installer is more difficult for us to pinpoint and may be absent from the analysis.
Malicious EDR incidents by remote access tool (January 2025 – March 2026):
Data shows RDP tops with almost 26% as it is built into Windows for legitimate remote administration and it is easily ‘weaponized’ by attackers after initial compromise to gain admin-level access without installing anything new.
Before we dig deeper into the findings, one interesting observation emerges when we compare the RMMs most frequently used during EDR incidents, and how commonly they appear in our analysis of RMM app inventories. The former represents which RMMs are most frequently abused or deployed by attackers, and the latter represents which RMMs are legitimately installed by IT teams.
When these datapoints are analyzed together, it becomes clear that some tools are primarily used by attackers for malicious purposes, far outweighing their legitimate usage by IT teams. MeshAgent, for example, generated almost eight times more malicious incidents than it has legitimate installation. Ammyy Admin generated almost 153 times more malicious incidents than legitimate installations. These tools seem to exist in the data almost exclusively because an attacker put them there.
Compare that to ConnectWise ScreenConnect (where the number of legitimate installations outnumber EDR incidents 604 to 1) or AnyDesk (1,591 to 1). These tools appear in attacks too, but the overwhelming majority of their installations are legitimate. This is, of course, not perfectly correlated between data sets, but just gives us an idea of what tools are more likely to be exclusively used during incidents.
It’s important to note that this is also a double-edged sword. While it may seem like an advantage that certain RMM products have more legitimate installations compared to incidents, it also means that attackers are more likely to slip in undetected or mask their malicious activity among the benign usage of those same tools, creating attacks that are more challenging for defenders to detect and stop.
This distinction matters for defenders. When your EDR flags MeshAgent on an endpoint, the appropriate response is immediate investigation and isolation. When it flags ConnectWise, the appropriate response depends on whether that endpoint is expected to have ConnectWise installed.
Rising threats: Monthly trend data
Monthly trend data offers an opportunity to investigate how attacks have changed over the past year:
These numbers are consistent with broader industry data. Proofpoint documented a shift from traditional loaders and botnets to RMM tools following law enforcement's Operation Endgame takedown of major botnet infrastructure in 2024, with 10+ different RMM tools now regularly observed in email campaigns (up from 2–3 in 2022).
The takeaways:
Open source RMM tools are favored by attackers: One such tool, MeshAgent, is almost exclusively an attacker tool in our data. Between September 2025 and March 2026, it generated 1,178 incidents. The increase in related incidents in the past nine months reflects both increased attacker adoption and increased EDR deployment that can detect it. MeshAgent's appeal is practical: it's open source, supports encrypted communication, works through NAT without port forwarding and provides full remote desktop and shell access. Multiple nation-state groups have adopted it, including campaigns attributed to North Korean (Andariel) and Iranian-linked groups. Similarly, we see the open source VNC in the top 5.
Leaked source code allows attackers to co-opt legitimate tools: Ammyy Admin follows a similar pattern to MeshAgent: the vast majority of EDR detections are attacker-deployed, not legitimate usage. This aligns with industry data: the leaked source code for Ammyy Admin v3 was weaponized into the "FlawedAmmyy" RAT, used extensively by financially motivated threat groups like TA505/FIN11.
RDP abuse is spiky and campaign driven: The September 2025 peak of 402 incidents and the March 2026 peak of 380 bookend a quiet stretch where monthly counts dropped as low as 39 in February. RDP involvement often signals the later stages of an attack: the attacker already has access and is using RDP to move through the network or maintain hands-on-keyboard control.
Conclusion
A few things stand out from the data above. Most managed endpoints have more than one remote access tool or RMM installed, often without a clear reason. Every extra tool means more accounts to manage and keep secure, more software to keep updated and more vulnerabilities attackers can target. Meanwhile, attackers have mostly stopped building their own remote access tools and now use the same ones IT teams rely on. Some, especially open-source ones, show up in attack data far more often than in real IT deployments, which usually means they are on a system because an attacker puts them there. Others are widely used and trusted by IT, and that is exactly what makes them useful in an attack: the activity blends in with normal admin work, and defenders have a harder time telling them apart.
In the next part of this blog, we will go through practical hardening guidance and recommendations for SMBs and MSPs: figuring out which remote access tools are actually installed across your endpoints, removing the ones that should not be there, locking down the rest and using your EDR to separate legitimate RMM activity from attacker activity.