RMM abuse surged in 2025 as ransomware groups weaponized legitimate IT tools like ScreenConnect, NetSupport, and SimpleHelp, chaining multiple agents on single hosts to survive takedowns. Key findings: - Adversaries deploy RMMs in layers: one documented case shows JumpCloud installing GetScreen, ScreenConnect, and SuperOps on the same host simultaneously, creating redundant footholds that survive single-agent removal (T1219) - ScreenConnect is nearly always a second-stage payload; its C2 domain often appears directly in the ScreenConnect.Client.exe command line, making process logs one of the few places a "malicious" domain is extractable without network inspection - NetSupport hides in C:\Users\Public\ or randomized folders; cracked copies use nonsense license strings like HANEYMANEY; network detection is reliable via User-Agent NetSupport Manager/1.3 - ITarian dropped DeerStealer and HijackLoader via sideloaded DLLs after staging through DicomPortable.exe; PDQ Connect stores its API token at C:\ProgramData\PDQ\PDQConnectAgent\token, which is the config artifact to pull in an investigation - MSIExec breaks the process tree: follow-on malicious activity runs under SYSTEM, severing the visible link to the phishing lure Hunt for RMM binaries in Downloads or Public folders whose metadata names a known RMM product but whose filename says Invoice.exe or Statement.msi. If you find one RMM, hunt for two more. Baseline authorized tools against lolrmm[.]io. #DFIR_Radar

2/ Front door is callback phishing or a fake IT help-desk call. The employee gets moved onto a remote-support session and talked into installing a legit RMM: AnyDesk, Zoho Assist, Bomgar, SuperOps.

⚠️Observed phishing URLs delivering RMM payload: RMM: SuperOps Theme: DocuSign URL: hxxps://zoom.allwellhealthcare[.]com/ File Download URL: hxxps://zoom.allwellhealthcare[.]com/Windows/download/index.php SHA256: 27e65692270c2425f261ff58b55c21c1f8488f613a10e95eff761e597e466bf2 #ThreatIntel #Phishing #RMM

Managing IT operations shouldn't require multiple disconnected tools. #SuperOps #MSP #ITManagement #RMM #PSA #ManagedServices #ITSupport #Automation #DigitalTransformation #ITOperation

South Central | #Exclusive: AI-first or workforce-first? That's the question! After reports of layoffs impacting nearly 30% of its workforce, SaaS startup SuperOps finds itself at the centre of the AI jobs debate. Is AI creating more opportunities than it is eliminating? SuperOps CEO Arvind Parthiban responds to the tough questions👇 Full Interview: youtube.com/watch?v=qRlSZ4aa… @JudeSannith24 @ArvindParthiban @Superops_com

South Central | Top business headlines from South India🔔 ➡️Tamil Nadu enforces tough liquor reforms ➡️Karnataka Cabinet: Ramalinga Reddy withdraws resignation ➡️SuperOps top boss clears the air on job cuts ➡️Marans launch micro-drama streaming platform ➡️IMD warns of heavy rains in coastal Karnataka

#91: #AIRadarDaily — @Superops_com For the IT service providers who keep other businesses running, the daily work is often a quiet, behind-the-scenes struggle. Talented IT professionals spend their days jumping between a half-dozen clunky, disconnected tools just to resolve a single issue. It is a slow, fragmented cycle. Instead of proactively helping their clients, they get buried in manual billing, noisy server alerts, and administrative chaos. It drains the joy out of IT support, leaving capable people feeling like exhausted ticket-chasers. SuperOps is stepping in to bring calm and unity back to IT operations. Founded in Chennai by Arvind Parthiban (@ArvindParthiban), SuperOps is an intelligent, unified platform built specifically to help Managed Service Providers (MSPs) run their entire business smoothly from one place. This is not just another patched-together IT dashboard that adds to the daily noise. Arvind and team have built a deeply thoughtful system that brings monitoring, ticketing, and billing into a single, seamless flow. The AI sits quietly in the background, filtering out the noise of thousands of false server alerts, naturally routing issues to the right person, and ensuring that the invoicing is perfectly tied to the work actually done. What makes SuperOps so special is the deep respect they have for the IT professional's daily life. It completely removes the "swivel-chair" fatigue of jumping between screens. By making the underlying technology invisible and the workflows natural, it gives service teams their time and dignity back. It replaces the constant anxiety of dropped tasks and missed invoices with a quiet, reliable sense of control. People are free to focus on actually caring for their clients' businesses. The market? IT service providers and growing tech support businesses globally that want to support their clients beautifully, without the heavy burden of legacy software. Arvind is a true change agent. He looked at a deeply unglamorous, often overlooked cornerstone of the business world — the people who keep the networks running — and chose to solve their pain with immense grace. Watching our homegrown founders build elegant, world-class infrastructure that respects the operator is a wonderful reminder of the larger, unfinished agenda we are all part of. They are giving IT teams their momentum back. Let's celebrate the builders. w/ @jaybharatingle & @dikshantjoshi #ITOps #ProductNation

🔰 Companies That Laid Off Indian Employees In 2026 📢 Oracle - 10,000 jobs 📢 Freshworks - 500 jobs 📢 Meta - Indian staff hit in global layoffs 📢 Atlassian - Indian staff affected 📢 Ola Electric - 620 jobs 📢 SuperOps - 60 jobs 📢 Pocket FM - 100 jobs

A lot happened in India’s startup ecosystem in April. As tensions in West Asia dragged on, funding activity at home slowed sharply. In the penultimate week of the month, startups raised just $39 Mn; the lowest weekly total so far since January 2025 📉 The pressure showed elsewhere, too. Ecommerce-focused AI startup NeuroPixel.AI and insurtech startup Covrzy shut down due to a cash crunch. Insurtech unicorn Acko and SaaS startup SuperOps also laid off a large number of employees Meanwhile, policy moves by the Centre and the RBI across gaming and fintech kept startups on edge. But, it wasn’t all gloom. Inc42’s Q1 2026 data shows that while funding declined YoY, investors are still deploying capital, just in smaller, more cautious bets 🤝 Inc42 is back with the ‘30 Startups To Watch’ series. The 69th edition of Inc42’s flagship series, powered by @peakxvpartners, features emerging ventures across foodtech, quick commerce and spacetech. #Inc42 #StartupIndia #FundingWinter #VentureCapital #TechStartups #IndianStartups #BusinessNews #Layoffs #Fintech #AI #trending

Enterprise tech startup SuperOps has laid off around 60 employees as part of a restructuring exercise aimed at improving efficiency and accelerating its transition into an AI-first organisation.👇 The startup confirmed the development with Inc42. It was first reported by Moneycontrol. The layoffs, largely from its engineering team of nearly 100 employees, account for nearly 30% of the startup’s overall workforce, the Moneycontrol report said. The restructuring decision was driven by the need to improve operational efficiency and align the startup’s structure with its long-term AI-focused roadmap, the report added. Founded in 2020 by Jayakumar K and Arvind Parthiban, who previously worked at Freshworks and Zoho Corporation, SuperOps is an AI-native, cloud-based platform for MSPs and internal IT teams. 🔗 Read the full article here: 4-2.co/4mVwWJi #Inc42 #news #Startups #Startuplayoff #StartupRestructuring

AI pivot triggers job cuts at SuperOps, 30% workforce affected: Report ebx.sh/73Tg0i

🚨 Tech 3 Today Just In: RBI cancels banking licence of Paytm One quick thing: Job cuts at Chennai-based SaaS firm SuperOps; engineering roles hit by AI In today’s newsletter: IT in the slow lane, again  The new age wealth managers Ranjan Pai wants a bite of Benne

#MCTech3 | Gloom and doom IT earnings season, a dosa chain gets VC money; and more… 🚨One quick thing: Job cuts at Chennai-based SaaS firm SuperOps; engineering roles hit by AI 📢Just In: RBI cancels banking licence of Paytm In today’s newsletter: ✅IT in the slow lane, again ✅The new age wealth managers ✅Ranjan Pai wants a bite of Benne Sign up for the newsletter ⤵️ moneycontrol.com/news/techno… #IT #Business #RBI #Paytm #AI

SuperOps lays off 30% workforce, cuts 60 roles in engineering amid AI-first shift @BhavyaDKumar ✍️ moneycontrol.com/news/busine…

🚨 EXCLUSIVE: SuperOps lays off 30% workforce, cuts 60 roles in engineering amid AI-first shift Chennai-based Software-as-a-Service (SaaS) startup SuperOps has laid off around 60 employees from its engineering team of nearly 100 people, as part of an internal restructuring exercise aimed at improving efficiency, sources told Moneycontrol. The layoffs, which account for roughly 30 percent of SuperOps' overall workforce, come as the company shifts towards becoming an AI-first organisation. Break by @BhavyaDKumar moneycontrol.com/news/busine…

#StartupsWithMC | SuperOps lays off 30% workforce, cuts 60 roles in engineering amid AI-first shift @BhavyaDKumar with more details👇 moneycontrol.com/news/busine…

🚨 تصاعد ملحوظ في حملات الهندسة الاجتماعية باستخدام مواقع اجتماعات مزيفة (Google Meet / Zoom وغيرها) في الفترة الأخيرة تم رصد عدة حملات تستخدم نفس الأسلوب، انتحال منصات الاجتماعات لخداع المستخدمين وتحميل أدوات تحكم عن بُعد. المهاجم يرسل رابط اجتماع، تدخل موقع يشبه Google Meet، تشوف مشاركين وهميين، ثم يُطلب منك تحميل تحديث أو Plugin. الملفات التي يتم تحميلها تكون أدوات RMM شرعية مثل: ScreenConnect أو MSP360 أو SuperOps، لكن يتم استخدامها للوصول الكامل للجهاز. اللافت هو العدد الكبير من الدومينات المزيفة، واللي تستهدف منصات مثل Google وZoom وTeams وAdobe. 🔎 في الرد تجد روابط لتغريدات باحثين تحتوي على IOCs مرتبطة بهذه الحملة.

🚩 https://google-meetingsnow[.]click Fake Google Meet website leads to SuperOps RMM. "GoogleMeet_ZZ8KR2F0O2RK_19SI0B7FBSUF4_windows_x64.msi": 54823b771fff807568622d35382e2cb15a03e6bcc5563b5f588ba6ef2b7bebc3 (SmartScreen & Defender 😴 VT: 1/63 ✅) REF: lolrmm.io/tools/superops.