October 29, 2026
- MDM as an initial-access and persistence channel: Huntress is seeing attackers social-engineer users into enrolling devices in attacker-controlled Hexnode and Rippling tenants, then push rogue RMM. In one case a removed ScreenConnect agent reappeared hours later, reinstalled through the unauthorized MDM agent. Hunt for unexpected enrollments, management agents and external relay connections; remediation means removing the endpoint from the rogue tenant and revoking tokens, not just deleting the RMM (Huntress). · Threat Activity