Attackers Are Turning Trusted Device Management Tools into Backdoors

Huntress has investigated several recent incidents in which attackers abused mobile device management (MDM) software to attack organisations. These tools are normally used by IT teams to enrol and configure laptops and phones, enforce security policies and deploy approved applications. Importantly, the attackers were not exploiting vulnerabilities in the products. They were misusing legitimate features, with Hexnode and Rippling named as examples. Huntress notes this is not a complete list of MDM tools that could be abused.

The incidents typically begin with social engineering. Victims receive business-themed lures through messaging applications or email, which lead them to enrol a device or install a management agent. Once a device is registered, the attacker gains a trusted and privileged management path on the system. In both cases Huntress describes, the attackers then installed unauthorised remote monitoring and management (RMM) tools to further their attacks.

This creates a tricky clean-up problem. Huntress describes a scenario where a team removes an unauthorised ScreenConnect agent after an alert, only to see the same installation reappear hours later. If the MDM enrolment remains in place, deleting the RMM tool alone may not end the intrusion. Because the deployment chain can vary, Huntress advises defenders to watch for unexpected MDM enrolments, management agents, RMM services and external relay connections.