{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rippling/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Hexnode MDM","Rippling MDM","ScreenConnect"],"_cs_severities":["high"],"_cs_tags":["phishing","mdm-abuse","rmm","persistence","initial-access"],"_cs_type":"advisory","_cs_vendors":["Hexnode","Rippling","ConnectWise"],"content_html":"\u003cp\u003eThreat actors are weaponizing legitimate Mobile Device Management (MDM) platforms, specifically Hexnode and Rippling, to gain unauthorized remote access. This activity involves social engineering users via business-themed phishing lures to trick them into installing an MDM agent. Once enrolled, the actor uses the MDM platform's native, trusted capabilities to deploy and re-deploy rogue Remote Monitoring and Management (RMM) tools, such as ScreenConnect. This mechanism allows the attacker to maintain persistence even after security teams remove individual RMM instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003ePhishing:\u003c/strong\u003e Users receive business-themed emails with subjects like \u0026quot;ATTN: Official Invitation to Submit Proposal.\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDelivery:\u003c/strong\u003e The emails contain links to a malicious domain.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDownload:\u003c/strong\u003e A file (e.g., eD0cuSign_Installer.msi) is downloaded to the user's browser temporary folder.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution:\u003c/strong\u003e The user executes the MSI, which installs a legitimate MDM agent (Hexnode) while masquerading as a different application (e.g., DocuSign).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnrollment:\u003c/strong\u003e The device is registered to an attacker-controlled MDM instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence:\u003c/strong\u003e The attacker uses the MDM platform to deploy or re-deploy unauthorized RMM software (ScreenConnect).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control:\u003c/strong\u003e The RMM agent connects to an attacker-controlled relay server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe use of legitimate MDM platforms provides attackers with an authenticated, privileged pathway to the system. This allows for persistent remote control that survives initial remediation attempts, as the MDM agent can automatically re-install removed RMM software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all MDM enrollments to identify unauthorized or rogue management agents.\u003c/li\u003e\n\u003cli\u003eMonitor for the installation of unauthorized RMM tools, particularly ScreenConnect, which may be deployed via MDM commands.\u003c/li\u003e\n\u003cli\u003eReview administrative logs of MDM platforms for anomalous enrollment patterns or unexpected deployment of remote access tools.\u003c/li\u003e\n\u003cli\u003eTrain users to verify the source of software installation packages, especially when they arrive via unexpected emails.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T17:43:32Z","date_published":"2026-10-28T17:43:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mdm-weaponization/","summary":"Threat actors are leveraging social engineering to enroll devices into legitimate MDM platforms like Hexnode and Rippling to gain privileged access and maintain persistence via unauthorized RMM deployment.","title":"Threat Actors Weaponizing MDM Platforms for Persistent Access","url":"https://feed.craftedsignal.io/briefs/2026-10-mdm-weaponization/"}],"language":"en","title":"CraftedSignal Threat Feed - Rippling","version":"https://jsonfeed.org/version/1.1"}