Huntress has documented incidents in which attackers used social engineering to enroll devices in mobile device management (MDM) environments under their control. The attackers relied on legitimate platforms, including Hexnode and Rippling, to deploy unauthorized remote management software and maintain access to compromised devices.
In one documented scenario, an attacker-controlled MDM tenant was used to reinstall ScreenConnect after an MSP removed it. The persistence mechanism illustrates how legitimate device management capabilities can be turned against defenders when unauthorized enrollment goes undetected. Huntress emphasized that the incidents involved deceptive enrollment tactics rather than exploitation of a vulnerability in the MDM products.
For MSPs, removing an unauthorized remote access tool may not be enough to end an intrusion. Technicians should investigate unexpected device enrollment, unfamiliar management agents, RMM services and outbound connections to remote access infrastructure. Identifying the management system responsible for reinstalling malicious tools is essential to preventing repeated compromise.
Source: Huntress
