Summary
- Attackers used fake business documents and meeting invitations to introduce management agents.
- Legitimate Hexnode and Rippling functionality provided persistent administrative control.
- Removing a rogue remote-access tool did not remove the underlying device enrolment.
Huntress has documented intrusions in which attackers deceived employees into installing legitimate device-management software configured under accounts controlled by the attackers. Once enrolled, the compromised computers could be managed through a trusted administrative channel, allowing unauthorised remote-access tools to be deployed and reinstalled even after local responders removed them.
The investigations involve the device-management platforms Hexnode and Rippling, which organisations ordinarily use to enrol laptops and phones, apply policy and distribute approved applications. Huntress says the attacks exploited the functions and trust assigned to those platforms, rather than software vulnerabilities in the products themselves. The malicious act was gaining control over the management relationship by persuading an employee to accept the install or enrolment process.
One incident began with phishing emails framed as invitations to submit a business proposal. The victim was directed to download a file represented as a DocuSign installer, but the package contained a legitimate Hexnode device-management client. Soon afterwards, attackers used the new administrative path to deploy ScreenConnect, a legitimate remote-control product, connecting the computer to infrastructure outside the employer’s control.
The organisation’s service provider removed the first unauthorised ScreenConnect installation, only to receive another alert several hours later when the same access software reappeared. Huntress traced the persistence to the earlier Hexnode enrolment: deleting the remote-control agent did not revoke the attackers’ ability to deploy it again through the management platform. The endpoint was subsequently isolated for more thorough remediation.
A separate case involved a receptionist who received a message styled as a Microsoft Teams invitation related to a tax enquiry. Huntress says the interaction led rapidly to the installation of a Rippling management agent under attacker control. The two cases illustrate different lures but a shared operational objective, placing a computer inside a management structure that appeared to use normal enterprise tools while authorising an external party to issue instructions.
A device-management service holds a particularly powerful position because it is expected to make changes without the friction associated with ordinary end-user applications. Security products may recognise the client as legitimate, and the service can run with permissions that a normal document or browser session would not receive. Attackers are therefore exploiting the distinction between trusted software and trusted control of that software. An authentic installer is not enough to establish that the management account behind it is authorised.
The findings are distinct from Cyber Insider’s earlier report on phishing that used MSP360 and ScreenConnect for persistence. In the new investigations the persistent foothold is an attacker-controlled mobile or endpoint device-management enrolment, while the remote-control tool is a payload that can be restored. A responder who focuses only on the visible RMM process may overlook the administrative relationship that caused the process to appear.
The chronology makes the initial enrolment a more reliable investigative marker than the later appearance of ScreenConnect. An authentic management installer can create an administrative relationship before any overtly suspicious remote-control activity is visible. Records of new management tenants, agent registration and policy-driven application installation may therefore establish which system was directing the device when subsequent software returned after removal.
Companies using outsourced endpoint support can have several legitimate management agents and administrators operating on a single device. That arrangement makes it harder to identify which management tenant should hold authority over the machine, particularly when an attacker installs a genuine client. Huntress did not identify compromises of the Hexnode or Rippling service providers or a systemic product flaw. The cases show that a fraudulent enrolment can create durable access through normal administration features, with repeated remote-control installation following from the retained management permissions. After removing the visible remote tool, the organisation in the Hexnode case still had to address the enrolment itself before control could be reliably withdrawn.
