Hexnode MDM - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hexnode-mdm/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 17:43:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThreat Actors Weaponizing MDM Platforms for Persistent Accesshttps://feed.craftedsignal.io/briefs/2026-10-mdm-weaponization/Wed, 28 Oct 2026 17:43:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mdm-weaponization/Threat actors are leveraging social engineering to enroll devices into legitimate MDM platforms like Hexnode and Rippling to gain privileged access and maintain persistence via unauthorized RMM deployment.Threat actors are weaponizing legitimate Mobile Device Management (MDM) platforms, specifically Hexnode and Rippling, to gain unauthorized remote access. This activity involves social engineering users via business-themed phishing lures to trick them into installing an MDM agent. Once enrolled, the actor uses the MDM platform's native, trusted capabilities to deploy and re-deploy rogue Remote Monitoring and Management (RMM) tools, such as ScreenConnect. This mechanism allows the attacker to maintain persistence even after security teams remove individual RMM instances.

Attack Chain

  1. Phishing: Users receive business-themed emails with subjects like "ATTN: Official Invitation to Submit Proposal."
  2. Delivery: The emails contain links to a malicious domain.
  3. Download: A file (e.g., eD0cuSign_Installer.msi) is downloaded to the user's browser temporary folder.
  4. Execution: The user executes the MSI, which installs a legitimate MDM agent (Hexnode) while masquerading as a different application (e.g., DocuSign).
  5. Enrollment: The device is registered to an attacker-controlled MDM instance.
  6. Persistence: The attacker uses the MDM platform to deploy or re-deploy unauthorized RMM software (ScreenConnect).
  7. Command and Control: The RMM agent connects to an attacker-controlled relay server.

Impact

The use of legitimate MDM platforms provides attackers with an authenticated, privileged pathway to the system. This allows for persistent remote control that survives initial remediation attempts, as the MDM agent can automatically re-install removed RMM software.

Recommendation

  • Audit all MDM enrollments to identify unauthorized or rogue management agents.
  • Monitor for the installation of unauthorized RMM tools, particularly ScreenConnect, which may be deployed via MDM commands.
  • Review administrative logs of MDM platforms for anomalous enrollment patterns or unexpected deployment of remote access tools.
  • Train users to verify the source of software installation packages, especially when they arrive via unexpected emails.
]]>highadvisoryphishingmdm-abusermmpersistenceinitial-access