{"version":1,"type":"story","url":"https://digestai.news/story/huntress-reports-ai-driven-rise-in-rmm-abuse-and-cybercrime-efficiency","json":"https://digestai.news/story/huntress-reports-ai-driven-rise-in-rmm-abuse-and-cybercrime-efficiency.json","markdown":"https://digestai.news/story/huntress-reports-ai-driven-rise-in-rmm-abuse-and-cybercrime-efficiency.md","slug":"huntress-reports-ai-driven-rise-in-rmm-abuse-and-cybercrime-efficiency","headline":"Huntress reports AI-driven rise in RMM abuse and cybercrime efficiency","summary":"Ben Bernstein, who leads Huntress’s Cybersecurity Advisors, says his decade‑long IT background helps him spot anomalies that AI‑generated attacks amplify. Attackers are using large language models to generate custom infostealer scripts on demand, lowering the technical skill needed for campaigns that previously required extensive development work.\n\nBernstein explains that RMM tools are attractive because they are signed, trusted, and run with elevated privileges, allowing attackers to bypass traditional antivirus and maintain persistence. He describes a typical intrusion that starts with a phishing email, leads to the installation of an unauthorized RMM agent such as Tiflux, and then cascades into additional legitimate‑looking agents like Splashtop and ScreenConnect. The resulting “daisy‑chain” of tools fragments telemetry, making detection harder unless organizations monitor behavior rather than relying on binary trust. Bernstein argues that AI speeds up each stage of the kill chain, but the fundamentals of security—patching, hardening, continuous monitoring, and human oversight—remain essential.","keyPoints":["Huntress saw a 277% YoY increase in remote monitoring and management (RMM) tool abuse.","AI‑generated LLM scripts let low‑skill attackers create custom infostealer code on demand."],"whyItMatters":"AI lowers the skill barrier for cybercrime, forcing businesses to shift from trusted‑software lists to continuous behavior‑based monitoring and posture management.","category":{"slug":"enterprise","name":"Enterprise & Industry","url":"https://digestai.news/category/enterprise"},"entities":{"companies":["Huntress","Red Canary","Integris","Tiflux","Splashtop","ScreenConnect"],"models":[],"people":["Ben Bernstein"]},"firstPublishedAt":"2026-09-18T19:17:48Z","updatedAt":"2026-09-18T19:17:48Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"Unite.AI","title":"Ben Bernstein, Manager of Cybersecurity Advisors at Huntress","url":"https://unite.ai/ben-bernstein-manager-of-cybersecurity-advisors-at-huntress-interview-series","publishedAt":"2026-09-18T19:17:48Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"Huntress reports AI-driven rise in RMM abuse and cybercrime efficiency\", 18 September 2026, https://digestai.news/story/huntress-reports-ai-driven-rise-in-rmm-abuse-and-cybercrime-efficiency","publisher":"Digest AI","title":"Huntress reports AI-driven rise in RMM abuse and cybercrime efficiency","datePublished":"2026-09-18T19:17:48Z","url":"https://digestai.news/story/huntress-reports-ai-driven-rise-in-rmm-abuse-and-cybercrime-efficiency"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}