Huntress Tragic Quadrant Ranks RMM Abuse, Mailbox Manipulation, and AiTM as Top Threats to SMBs in 2026
Huntress Labs’ Tragic Quadrant shows that rogue RMM installs, mailbox rule manipulation, and session‑hijacking attacks now dominate the threat landscape for small‑ and mid‑size businesses. The trend highlights the need for robust third‑party oversight and identity‑access controls to satisfy audit‑ready control objectives.
ADTP Breach Watch· October 27, 2026· BleepingComputer
SeverityHigh
Type👤 Threat intel
ConfidenceHigh
ReportedOct 27, 2026
Other / UnknownSmall and mid‑size businesses across all verticals that use RMM platforms or Microsoft 365Third-Party Dependency
Check if you use it. This incident came through a third party or the supply chain. If the product or supplier is in your estate or your vendors', start with the questions to ask below.
What happened
Huntress Labs published its quarterly “Tragic Quadrant,” a ranking of the cyber‑tactics that cause the most operational disruption for SMBs. Based on thousands of endpoint investigations, the report identifies three high‑impact tactics: (1) RMM abuse – accounting for 45 % of endpoint incidents, where attackers install rogue remote‑monitoring agents that appear as normal admin activity; (2) Mailbox manipulation – 24.6 % of ITDR signals involve compromised Microsoft 365 mailboxes used to rewrite rules and divert payments; (3) Adversary‑in‑the‑Middle (AiTM) – 18.9 % of identity‑based threats bypass MFA by hijacking the login session between the user and Microsoft 365. The quadrant is meant to guide organizations in prioritizing defenses against tactics that hide inside trusted tools and daily workflows.
Why it matters for trust and compliance
These tactics test the control objective of managing and monitoring vendor‑supplied software and privileged access, a core element of audit‑ready governance across frameworks.
Continuous monitoring of third‑party RMM agents provides defensible evidence for vendor‑risk controls.
Documented mailbox‑rule change alerts satisfy identity‑access control requirements in audit programs.
Who is affected
Small and mid‑size businesses across all verticals that use RMM platforms or Microsoft 365
Recommended actions
Create a definitive inventory of all RMM and remote‑access tools and enforce least‑privilege configurations.
Implement real‑time monitoring of mailbox rule changes and anomalous login sessions.
Upgrade MFA to phishing‑resistant methods and require session re‑authentication for high‑risk actions.
Integrate third‑party risk monitoring into your continuous audit evidence collection.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.