Huntress: phished MDM enrolments in Hexnode and Rippling give attackers a management path that brings ScreenConnect back after it has been removed
Huntress: phished MDM enrolments push ScreenConnect back after removal; the RMM is not the root of the intrusion
Defender actions
- On every endpoint from which an unauthorised ScreenConnect or other RMM agent has been removed, check for a Hexnode or Rippling MDM agent or enrolment that nobody authorised and unenrol the device from that tenant, because in Huntress's Hexnode case ScreenConnect returned hours after its removal while the MDM client stayed.
Analysis
Huntress reports several recent incidents in which attackers used legitimate mobile-device-management platforms, not flaws in them, as a trusted management path, naming Hexnode and Rippling as the two it saw and noting the list is not definitive (Huntress, 2026-10-28). In the first case, proposal-themed emails led a user to download an MSI named like a DocuSign installer that installed Hexnode components (gateway, agent and PostgreSQL components); ScreenConnect followed shortly after and connected to an attacker relay, the managed-service provider removed it, and it came back several hours later to the same relay while the Hexnode client was still installed (Huntress, 2026-10-28). In the second, a receptionist clicked a link in an email about tax planning that led to a fake Teams calendar page; about a minute later a Rippling enrolment registry key appeared, the agent was downloaded into a SYSTEM profile path and installed with SYSTEM rights, and about 35 minutes after that the attacker used the MDM to stage and run a ScreenConnect installer as SYSTEM (Huntress, 2026-10-28).
Triage: a corporate enrolment started by IT looks similar in process telemetry; the discriminators are a tenant that is not in the authorised inventory, a trigger that is an emailed link or a user-run installer instead of IT's enrolment workflow, and an RMM install within minutes (an inference from Huntress's two cases).
Cited evidence
removing it does not remove the unauthorized management architecture that delivered it.
MDM enrollment should be treated as security-sensitive activity as opposed to a routine administrative task.
Maintain an inventory of authorized MDM products, tenants, agents, and RMM instances.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.