Cybercriminals Shift Tactics: Group Deploys Multiple RMM Tools (ScreenConnect, LogMeIn, Naverisk) for Redundant Persistence and Access Resale

A highly active cybercriminal group has shifted tactics in a long-running campaign that abuses remote monitoring and management software to infiltrate corporate environments, according to The Threat Hunter Team at Broadcom. The actor is now deploying multiple RMM tools across compromised networks—often weeks apart—to extend persistence and prepare systems for potential resale or deeper compromise.

Since at least April 2025, the campaign has shown the threat actor’s growing sophistication and determination to maintain long-term access inside victim organisations. Attacks begin with phishing emails containing malicious URLs leading to setup executables or MSI installers, with lure themes including holiday party invites or invoices and notices.

The group has expanded its arsenal beyond ScreenConnect to include LogMeIn Resolve, Naverisk, SimpleHelp, PDQ and Atera, using them in a staggered fashion so that one tool installs another, sometimes with days or weeks between deployments. The overall objective is persistent access and credential theft, which investigators say may enable access resale to other threat actors for further compromise.