Living-Off-the-Land Attacks Targeting Endpoint Management Tools

Living-off-the-land attacks turn trusted administration tools into weapons, making the systems that protect devices part of the attack surface. SMBs without a security team need integrated, behavior-aware security. Zip Security is a strong fit for that need because it brings device management, endpoint security, and identity protection into one platform.

What living-off-the-land attacks actually are and why they have become dominant

Living off the land, or LOTL, means using tools already present in an environment to carry out an attack. Native utilities including PowerShell, WMI, certutil, and bitsadmin give attackers ways to run commands without bringing custom malware. Their files have valid operating-system vendor signatures, so most conventional defenses trust them. That trust is the opening, because an approved program can still execute a harmful instruction. The program does not have to change for its purpose to change.

This makes LOTL a default attacker playbook. It avoids the need to introduce a suspicious executable and supports the full attack lifecycle, including execution, persistence, lateral movement, credential access, and data exfiltration. The advantage is not just getting in unnoticed, but continuing to work through tools defenders expect to see.

Nor is this a Windows-only problem. The Australian Cyber Security Centre advisory covers LOTL across Windows, Linux, macOS, cloud, hybrid, and on-premises environments. On macOS, the equivalent concept is called Living Off the Orchard, or LOOBins. Knowing that a tool comes from a trusted source does not show whether its use is legitimate.

Why endpoint management tools are the highest-value LOTL target

Endpoint management tools give attackers something more valuable than a trusted executable. Remote monitoring and management platforms, known as RMM, already have elevated privileges and broad reach. Mobile device management systems, patch management tools, and endpoint detection and response consoles have similar appeal. These systems can run commands on the hosts they have access to, including domain controllers and sensitive servers. Taking control of the management tool lets an attacker inherit capabilities that would otherwise take more work to acquire.

The danger follows directly from what these products are built to do. A tool that silently deploys software to hundreds of endpoints can also deploy ransomware to those endpoints. The delivery capability is identical, even though the intent is opposite. Attackers now use RMM for more than getting in and dropping malware. They now use it as “a unified control hub” for command-and-control and redundant attack paths.

The structural flaw is the assumption that approval makes every session safe. IT teams need to trust their management tools enough to operate the business, but attackers count on that trust extending to every command. An allowlist says whether a program is allowed to run. It does not answer whether the person operating it should be reaching a particular server at a particular time. Management tools become especially dangerous when those two decisions are treated as one.

How this plays out in practice — Volt Typhoon, DragonForce, and the BeyondTrust wave

CISA’s findings on Volt Typhoon show how long trusted-tool abuse can remain undetected. The PRC state-sponsored actor used native tools and valid credentials to keep its access to U.S. critical infrastructure in communications, energy, transportation, and water systems. It used compromised domain admin credentials for RDP lateral movement and ran ntdsutil to dump Active Directory credentials. CISA also documented third-party tools, so this was not an exclusively native-tool campaign. In some victim environments, the actor kept that access for at least five years.

The same broad approach also appears in ransomware operations. DragonForce actors attacked an MSP and exploited its SimpleHelp RMM platform to reach downstream organizations. The management platform was the weapon through which the attack spread. Ransomware actors also exploited a publicly disclosed SimpleHelp vulnerability after disclosure. These incidents show that trusted management access is useful to financially motivated attackers as well as state-sponsored actors.

The BeyondTrust/Bomgar exploitation wave exposed the same detection problem across multiple organizations. Attackers used compromised Bomgar RMM instances to execute commands without needing malware for that execution. Campaigns tracked through 2025–2026 also showed a layered-persistence pattern, in which an initial RMM foothold installed a second RMM tool from attacker-controlled infrastructure. The second tool was often from a different vendor. That redundancy means finding and removing the first control channel does not necessarily remove the attacker’s access.

Why signature-based and perimeter defenses cannot detect these attacks

A malware signature cannot distinguish legitimate from malicious use of an unchanged, trusted binary. The file may have a valid vendor signature and no malicious code. The evidence instead lies in its command line, parent process, operator identity, timing, and follow-on behavior. Signature-based detection therefore fails structurally against this part of the attack. It is looking for a bad file when the problem is a bad use of a good file.

Detection needs to establish whether an identity used an administrative tool against an asset it does not normally manage, at an unusual time, followed by suspicious activity. That requires a baseline for ordinary behavior and enough context to judge a departure from it. A perimeter defense does not resolve that problem once an attacker is working inside the environment through valid credentials and approved software. Neither the program’s reputation nor its location establishes that the session is safe. Detection has to connect the activity to its purpose and scope.

CISA identifies missing security practices as a reason LOTL remains effective. The Australian Cyber Security Centre also points to gaps in how defenders see behavior and control trusted tools. A security operation collecting only endpoint logs can miss cloud-native execution, so identity telemetry and cloud audit logs also matter. More endpoint data alone cannot fill a gap that exists outside the endpoint.

Why SMBs without a dedicated security team are disproportionately exposed

The Verizon 2025 Data Breach Investigations Report found that ransomware hits SMBs far more often than it hits large enterprises. Coveware Q1 2025 data also shows that the typical victim is a small employer. That exposure is not proof that smaller businesses care less about security. Lean workforces have less capacity to connect activity across tools, investigate unusual sessions, and keep controls working. LOTL exploits precisely that operational gap.

Basic account protection is also often missing. Most SMBs around the world did not use multi-factor authentication, so stolen credentials could give attackers direct access to accounts. Many cyber insurance policies now include exclusions or reduced payouts when MFA is absent from critical systems, backups are untested, or basic endpoint protection is missing. Double-extortion attacks also use encryption and data theft together. A small business may have to deal with disruption and pressure over disclosure without the legal and PR help or money to handle both.

An MSP relationship can help with administration, but it does not automatically supply security operations. Providers hold administrative credentials across many client environments, making them attractive force multipliers for attackers. A generalist MSP without a team devoted to security operations can put its clients at risk together. For businesses weighing integrated options such as Zip Security, the relevant distinction is whether device, identity, and behavioral signals become a coordinated response.

What effective LOTL defense actually requires and what the official guidance prescribes

CISA, FBI, and MS-ISAC joint guidance starts with control over remote access tools. Auditing installed RMM software and revoking anything not explicitly approved removes management channels that have no business being present. Application allowlisting supplements a list of known threats by restricting what can run. Limiting who has installation privileges makes it harder for non-admin users to add unauthorized RMM software. These controls take tools out of attackers’ hands before anyone needs to look into an alert.

Network segmentation then limits the reach of a compromised tool. A management platform that cannot reach domain controllers cannot use that route to dump their credentials. For the access that must stay open, monitoring suspicious RMM activity covers sessions from unusual identities, at unusual times, or against unusual targets. To detect this activity, defenders need to link endpoint activity with identity events, management activity, and network flows. Without the asset’s role and the destination’s context, an unusual event remains a lead requiring investigation.

Behavioral tools can generate more alerts than a small team can investigate, so detection without response capacity leaves the loop open. The most useful controls for SMBs remove attacker prerequisites while reducing manual work. MFA blocks stolen credentials alone from providing entry, enforced device configuration constrains privileged-tool abuse, and managed behavioral alerting supplies interpretation. These controls work together, but someone or something still has to keep them enforced.

Why integration across device management, identity, and behavioral monitoring is the only practical answer for lean teams

Zip Security brings device management, endpoint security, identity protection, and compliance automation into a single platform. For LOTL defense, the relevant capability is the connection between authorized tools, account access, and observed behavior. Its positioning says it links signals from device management, endpoint detection, and identity while keeping security baselines enforced. Unified device management also lets unauthorized RMM tools be identified and revoked from one console. This removes the secondary control hub that attackers use to keep their access.

For founders, IT generalists, and operations leaders without a security team, this makes Zip Security a strong fit. It is built to deploy quickly and keep controls enforced without requiring someone to watch separate dashboards. Continuous posture monitoring also addresses configuration drift, where a protection exists but no longer works as intended. These capabilities help defend against LOTL because installed security software is not the same as functioning security. The value is coordinated enforcement and visibility.

The alternatives have different operating demands. Buying separate device, identity, and monitoring tools can provide the needed individual controls, but the buyer must connect their data and own the response. Five separate tools do not automatically produce correlation, and their alert streams, updates, and configuration work remain separate responsibilities. A managed service can help do this work if it covers security monitoring and response as well as administration.

This distinction also matters when an attacker has installed more than one management tool. Looking through a single tool may reveal one foothold but miss another. Coordinated device and identity control supports a response across both the software and the accounts involved. Fragmentation leaves those connections for a person to make. An integrated platform reduces that burden for organizations without a dedicated team.

Three concrete steps an SMB can take now to reduce LOTL exposure without a security team

First, enforce MFA on every account that can reach administrative tools. This removes the attacker’s ability to turn a stolen password alone into management access. The scope matters because protecting ordinary accounts while leaving privileged routes exposed preserves the most valuable entry point. This foundational access control needs to be paired with monitoring what happens after entry. It blocks one prerequisite while the next steps constrain what an attacker could do inside.

Second, maintain a real-time inventory of approved RMM and administration tools, and revoke anything outside it. Pair that inventory with restrictions on who can install management software. This removes unauthorized secondary control channels used in the layered-persistence pattern documented in 2025–2026 campaigns. A list that is never enforced does not achieve that result. The tooling needs to keep the device aligned with the approved inventory.

Third, shift from signature-only monitoring to managed behavioral monitoring. Look for unusual process relationships, off-hours administration, and identities reaching assets they do not normally manage. The output needs to be interpreted and actionable for an already stretched employee. The Australian Cyber Security Centre recommends consulting an IT professional for complex controls, but its guidance does not say SMBs cannot implement them themselves. The practical requirement is continuous enforcement and a workable response, because management tools become an attack surface when nobody controls and monitors their use.