CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Rippling MDM

product · product:rippling-mdm single-source

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
Huntress: phished MDM enrolments push ScreenConnect back after removal; the RMM is not the root of the…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
1
1 hosts

Action items (1)

Do-now tasks recorded on the entries about Rippling MDM, newest first. Check the date before acting on an older one.

  • On every endpoint from which an unauthorised ScreenConnect or other RMM agent has been removed, check for a Hexnode or Rippling MDM agent or enrolment that nobody authorised and unenrol the device from that tenant, because in Huntress's Hexnode case ScreenConnect returned hours after its removal while the MDM client stayed.
    2026-10-29Huntress: phished MDM enrolments push ScreenConnect…

Defender insights

What each entry about Rippling MDM tells a defender to do, newest first.

2026-10-29NOTABLEHuntress: phished MDM enrolments push ScreenConnect back after removal; the RMM is not the root of the intrusion

Exposure · triage · detection

Story timeline

  1. 2026-10-29Huntress: phished MDM enrolments in Hexnode and Rippling give attackers a management path that brings ScreenConnect back after it has been removed
    active-threatsHuntress: phished MDM enrolments push ScreenConnect back after removal; the RMM is not the root of the intrusion

Hunting pivots

Releases covered
Rippling MDM
Tags
phishing
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessPhishing: Spearphishing Link
  • ExecutionSoftware Deployment Tools · User Execution: Malicious File
  • Lateral MovementSoftware Deployment Tools
  • Command and ControlRemote Access Tools

Initial Access TA0001

T1566.002Phishing: Spearphishing Link×1

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect · ATT&CK page ↗

Execution TA0002

T1072Software Deployment Tools×1

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

Evidence: 2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect · ATT&CK page ↗

Lateral Movement TA0008

T1072Software Deployment Tools×1

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

Evidence: 2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-10-29/huntress-mdm-enrolment-brings-back-removed-screenconnect · ATT&CK page ↗

Entries about Rippling MDM (1)

2026-10-29 · view entry permalink →

NOTABLENATOB2

Huntress: phished MDM enrolments in Hexnode and Rippling give attackers a management path that brings ScreenConnect back after it has been removed

Huntress reports several recent incidents in which attackers used legitimate mobile-device-management platforms, not flaws in them, as a trusted management path, naming Hexnode and Rippling as the two it saw and noting the list is not definitive (Huntress, 2026-10-28). In the first case, proposal-themed emails led a user to download an MSI named like a DocuSign installer that installed Hexnode components (gateway, agent and PostgreSQL components); ScreenConnect followed shortly after and connected to an attacker relay, the managed-service provider removed it, and it came back several hours later to the same relay while the Hexnode client was still installed (Huntress, 2026-10-28). In the second, a receptionist clicked a link in an email about tax planning that led to a fake Teams calendar page; about a minute later a Rippling enrolment registry key appeared, the agent was downloaded into a SYSTEM profile path and installed with SYSTEM rights, and about 35 minutes after that the attacker used the MDM to stage and run a ScreenConnect installer as SYSTEM (Huntress, 2026-10-28).

Triage: a corporate enrolment started by IT looks similar in process telemetry; the discriminators are a tenant that is not in the authorised inventory, a trigger that is an emailed link or a user-run installer instead of IT's enrolment workflow, and an RMM install within minutes (an inference from Huntress's two cases).

removing it does not remove the unauthorized management architecture that delivered it.

MDM enrollment should be treated as security-sensitive activity as opposed to a routine administrative task.

Maintain an inventory of authorized MDM products, tenants, agents, and RMM instances.

Huntress 2026-10-28
threat29 Oct 04:45Zsingle-sourceOpen finding →
Sources: Huntress

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • huntress.com1 (100%)
All cited sources (1)