Compromised Atera RMM Used to Target Three MSP Customers
Summary
Huntress traced malicious activity at three MSP customers to a compromised Atera RMM instance. The actor created local administrator accounts and installed Cloudflared tunnels; Huntress isolated affected endpoints before the attacks progressed further.
Key points
- Huntress observed the threat actor use an MSP’s compromised Atera RMM instance to target three downstream customers.
- In two incidents, the actor used net.exe to add accounts to local administrators groups; reported account names included msoit, se91, veean, and vnaee.
- The actor installed Cloudflared tunnels on all three customers using the same token, potentially enabling persistent access.
- Huntress isolated the affected endpoints before data theft or ransomware deployment occurred.
- Huntress advised the MSP to shut down its RMM instance, rotate credentials, and remove newly created accounts.
- Recommended defenses include auditing and monitoring remote-access tools, restricting their use, applying application controls, reviewing logs, and keeping RMM software updated.
Article Details
- Attack Vectors
- A threat actor compromised an MSP’s Atera RMM instance and used it to execute commands across endpoints at three downstream customers.
- In two of the three reported incidents, net.exe was executed through the RMM to enumerate systems and add users to the local administrators group.
- The threat actor installed Cloudflared tunnels on all three customers using the same token, establishing a potential route for persistent access.
- The article also cites other RMM abuse patterns: hijacking existing software such as TeamViewer, installing additional RMM tools after compromise, and exploiting RMM vulnerabilities. The 2021 Kaseya incident involved an arbitrary file upload and code injection flaw.
- Defensive Notes
- Audit, track, and monitor remote-access tools to identify unauthorized RMM instances.
- Require authorized RMM tools to be used from within the network and through approved remote-access solutions such as VPNs.
- Use application controls to block installation and execution of unauthorized RMM software.
- Review logs for RMM execution and use EDR to distinguish malicious RMM activity from legitimate use.
- Maintain an asset inventory that includes installed applications and continually review access controls.
- Keep RMM tools updated with the latest vulnerability fixes.
- For the reported incident, Huntress isolated impacted endpoints and advised the MSP to shut down its RMM instance, rotate credentials, and remove newly created accounts.
MITRE ATT&CK
Products
Aterato the local administrators group via an RMM. In this case, the threat actor had compromised the MSP’s Atera RMM instance. The Huntress agent was only installed on one of the MSP’s endpoints, limiting visibility andCloudflaredAs Figure 2 shows, the threat actor also installed Cloudflared tunnels on all three customers with the same token (as seen by the following command: C:\Windows\system32\cloudflared.exe"tunnelrun–token [REDACTED]).WeKaseya VSAThe community saw this play out during the infamous 2021 Kaseya VSA supply chain attack. The ransomware attack impacted between 50 and 60 MSPs and resellers, but the brunt of the impact was felt most directly by theirTeamViewerAttackers hijack and use existing software that's already installed on victims’ endpoints. Last year, we saw an incident where the threat actor obtained initial access via a legacy instance of TeamViewer