Dual-RMM Redundancy: How Attackers Are Building Backdoors That Survive Detection

Published: May 8, 2026

Source: CYFORi Research — Analysis of the VENOMOUS#HELPER phishing campaign and dual-RMM attack methodology tracked by Securonix.

Key References: Securonix threat research, SSA phishing campaign analysis, RMM tool exploitation reporting.

The Attack — A Masterclass in Professional Hacking

Weeks ago, a phishing campaign tracked as VENOMOUS#HELPER compromised more than 80 organizations across the U.S. using an approach that demonstrates a level of sophistication rarely seen against SMBs.

Here's how it worked:

1. The Lure: Phishing emails impersonated the Social Security Administration — leveraging government authority for high click-through rates
2. The Delivery: The email delivered a customized version of SimpleHelp — a legitimate remote monitoring and management (RMM) tool that every MSP and IT manager recognizes
3. The Access: Using SimpleHelp's own signed binary, the attacker installed themselves, escalated to SYSTEM-level access, and gained full administrative control
4. The Innovation: They then installed a second RMM tool — ConnectWise ScreenConnect — as a fallback

Think about that for a moment. If a defender detected SimpleHelp and removed it, ScreenConnect stayed open. If they removed ScreenConnect, SimpleHelp stayed open. This is redundant access — professional infrastructure-grade threat ops against small businesses.

Why This Is Different From Normal Ransomware

Securonix assessed this as a financially motivated Initial Access Broker operation — meaning these attackers aren't encrypting files themselves. They're selling access to ransomware operators.

That means the initial compromise is only the beginning. The attackers can come back months from now, when a ransomware crew buys that access and starts encrypting files. The door is already built — they just have to walk through it.

What Texas SMBs Should Audit This Week

Every RMM Tool You Use

• Are these tools running on machines they're supposed to manage? Verify every installation against your change management logs
• Are you tracking who installed them and when? If an RMM appears on a machine without a change ticket, that's a red flag
• Do you have visibility into every RMM deployment across your entire environment? If your answer is "I think so," that's a problem

This Week

1. Inventory all RMM tools: SimpleHelp, ConnectWise ScreenConnect, TeamViewer, AnyDesk, and others
2. Audit installation logs: Compare installations against change management records
3. Check for unsigned or unexpected installations: Any RMM tool you didn't authorize is a potential backdoor

The CYFORi Takeaway

VENOMOUS#HELPER represents a shift in how SMBs are targeted. These aren't random attacks — they're professional operations with professional infrastructure. The attackers built redundant access channels because they expected resistance. That tells you two things:

1. They expect to be detected — and they planned for it
2. They have months to come back — and they'll use that time to plan the ransomware event

For Texas SMBs, the takeaway is clear: audit your RMM deployments. Now. Not next week.