Elastic Report: Attackers Abuse RMM Tools, AI Assistants and Identity Trust for Fast, Malware-Free Intrusions
Elastic Security Threat Command's quarterly threats, etc report (April-September 2026) describes a shift away from traditional malware toward abuse of legitimate, trusted software and workflows to gain and maintain access. Based on confirmed customer intrusions, the report highlights three trends: abuse of signed RMM tools (with ScreenConnect named most often, 23 confirmed findings), AI coding assistant/agent-driven attacks generating tens of thousands of actions in days, and identity-based compromise via AiTM phishing and legacy authentication gaps that can turn an infostealer infection into tenant login within minutes. A healthcare intrusion is cited where a paste-and-run lure led to MSI delivery with DLL sideloading in roughly 16 seconds, and a separate case saw an AI agent produce ~17,600 reconstructed actions over four days. The report argues signature-based detection is insufficient against signed-software abuse and recommends UEBA, cross-domain visibility, and automated triage (e.g., Elastic Workflows) to keep pace with machine-speed attacks.
Detalhes técnicos
- RMM abuse: 23 confirmed findings this quarter; ScreenConnect most frequently abused; one healthcare case chained a paste-and-run lure to MSI delivery with DLL sideloading in ~16 seconds.
- AI agent abuse: one intrusion involved an AI agent generating ~17,600 reconstructed actions over four days.
- Identity abuse: AiTM phishing kits and legacy authentication protocol gaps used to bypass MFA; average time from infostealer credential theft to attacker login observed at 8 minutes.
- Attackers increasingly rely on legitimate, signed first-party tools (RMM agents, AI coding assistants, Microsoft first-party clients) rather than custom malware.
Remediação
Elastic recommends deploying user and entity behavior analytics (UEBA) to baseline normal activity, cross-domain visibility and correlation across environments, and shifting detection to system-level behavioral outcomes (e.g., memory tampering, proxy tunneling) rather than signature-based approaches. Automated triage pipelines combining telemetry, deterministic rules and AI reasoning (e.g., Elastic Workflows) are suggested to manage the resulting alert volume and keep pace with attack speed.
Linha do tempo
-
Elastic Report: Attackers Abuse RMM Tools, AI Assistants and Identity Trust for Fast, Malware-Free Intrusions
ler a análise desta fonte ocultar
Elastic Security Threat Command's quarterly threats, etc report (April-September 2026) describes a shift away from traditional malware toward abuse of legitimate, trusted software and workflows to gain and maintain access. Based on confirmed customer intrusions, the report highlights three trends: abuse of signed RMM tools (with ScreenConnect named most often, 23 confirmed findings), AI coding assistant/agent-driven attacks generating tens of thousands of actions in days, and identity-based compromise via AiTM phishing and legacy authentication gaps that can turn an infostealer infection into tenant login within minutes. A healthcare intrusion is cited where a paste-and-run lure led to MSI delivery with DLL sideloading in roughly 16 seconds, and a separate case saw an AI agent produce ~17,600 reconstructed actions over four days. The report argues signature-based detection is insufficient against signed-software abuse and recommends UEBA, cross-domain visibility, and automated triage (e.g., Elastic Workflows) to keep pace with machine-speed attacks.
Technical Details
- RMM abuse: 23 confirmed findings this quarter; ScreenConnect most frequently abused; one healthcare case chained a paste-and-run lure to MSI delivery with DLL sideloading in ~16 seconds.
- AI agent abuse: one intrusion involved an AI agent generating ~17,600 reconstructed actions over four days.
- Identity abuse: AiTM phishing kits and legacy authentication protocol gaps used to bypass MFA; average time from infostealer credential theft to attacker login observed at 8 minutes.
- Attackers increasingly rely on legitimate, signed first-party tools (RMM agents, AI coding assistants, Microsoft first-party clients) rather than custom malware.
Remediation
Elastic recommends deploying user and entity behavior analytics (UEBA) to baseline normal activity, cross-domain visibility and correlation across environments, and shifting detection to system-level behavioral outcomes (e.g., memory tampering, proxy tunneling) rather than signature-based approaches. Automated triage pipelines combining telemetry, deterministic rules and AI reasoning (e.g., Elastic Workflows) are suggested to manage the resulting alert volume and keep pace with attack speed.