Huntress Reports New Bomgar Exploitation Incidents, Including LockBit Ransomware Attacks
Summary
Huntress reports a rise in Bomgar incidents likely exploiting CVE-2026-1731. Attackers used compromised instances for downstream access, persistence, reconnaissance and, in some cases, LockBit ransomware.
Key points
- Huntress observed a renewed rise in Bomgar incidents from April 3, following earlier exploitation after CVE-2026-1731 was disclosed in February.
- The flaw allows unauthenticated remote code execution; Huntress says affected organizations were running outdated Bomgar versions, though the specific root cause of the recent incidents is not confirmed.
- Attackers used compromised Bomgar access to reach downstream customers, including through an MSP environment; one incident led to the isolation of 78 businesses.
- Observed activity included account creation and privilege escalation, domain reconnaissance, network enumeration, and deployment of additional remote-management tools such as AnyDesk and Atera.
- Huntress observed LockBit ransomware deployment in multiple incidents, and suspects some attackers used a previously leaked LockBit 3.0 builder.
- BeyondTrust patched CVE-2026-1731; Huntress advises applying the fixes, checking Bomgar versions, monitoring privileged-account changes, and auditing authorized RMM tools.
Article Details
- Attack Vectors
- Exploitation of outdated Bomgar instances, likely involving CVE-2026-1731, to obtain remote code execution.
- Abuse of compromised or rogue Bomgar RMM access to deploy additional remote access tools and reach downstream customer environments.
- Creation of local accounts and addition of accounts to Local Administrators and Domain Admins groups for persistence and elevated access.
- Deployment of LockBit ransomware and use of suspicious drivers to target security tooling.
- Defensive Notes
- Apply the CVE-2026-1731 patches and verify that Bomgar/Remote Support or Privileged Remote Access is running a fixed version.
- Monitor for suspicious accounts added to Local Administrators or Domain Administrators groups.
- Audit authorized RMM tools and review logs for suspicious RMM executions.
- Check the installed Bomgar product version through the appliance admin interface.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
lokbt9@onionmail[.]org | Email address included in ransom notes observed in two incidents. | |
| IPV4 | 146[.]70[.]41[.]131 | IP address to which the renamed SimpleHelp RMM was configured. |
| SHA256 | 3529b1422da886b7d04555340dfb1efd44a625c2921af6df39819397176956d6 | Hash of the ransomware executable identified as LB3.exe in the April 14 incident. |
| SHA256 | 538b3b36dd8a30e721cc8dc579098e984cf8ed30b71d55303db45c7344f7a4cf | Hash of the ransomware executable identified as LB3.exe in the April 12 incident. |
| SHA256 | a5035cbd6c31616288aa66d98e5a25441ee38651fb5f330676319f921bb816a4 | Hash of PoisonX.sys, a driver deployed in the April 12 incident; the article says it may be linked to a tool designed to terminate EDR agents. |
| SHA256 | b44dd12179a15a7d89c18444d36e8d70b51d30c7989d3ab71330061401f731fe | Hash of HRSword.exe, legitimate software the article says was abused by cybercriminals to bypass security defenses. |
| SHA256 | bc9635dcc3444c18b447883c6bc1931e5373e48c7dbfaa607285a9fb668b03ea | Hash of InputUpdate.exe, a renamed SimpleHelp RMM reported on a system during the March 11 incident. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThreat actors used NetScan for network enumeration.T1053.005 · Scheduled TaskA scheduled task named AteraAgentServiceWatchdog was created during an April 3 incident.T1059.003 · Windows Command ShellThe article reports commands executed through Bomgar remote shell and a command prompt session, including execution of LB3.exe.T1087.002 · Domain AccountThreat actors conducted domain account reconnaissance, including with nltest.exe.T1136.001 · Local AccountThreat actors created new local user accounts on compromised systems.T1190 · Exploit Public-Facing ApplicationThe incidents likely involved exploiting CVE-2026-1731 in outdated Bomgar instances to obtain remote code execution.T1219 · Remote Access ToolsThreat actors deployed or executed AnyDesk, Atera, ScreenConnect, and a renamed SimpleHelp RMM for remote access and persistence.T1486 · Data Encrypted for ImpactLB3.exe ransomware successfully encrypted endpoints in reported incidents.T1562.001 · Disable or Modify ToolsThreat actors deployed suspicious drivers, including PoisonX.sys, in an effort to terminate EDR agents.
CVE
People
Amelia CasleyAcknowledged for contributions to the research and blog.Austin WorlineAcknowledged for contributions to the research and blog.Jamie DumasAcknowledged for contributions to the research and blog.Jordan SextonAcknowledged for contributions to the research and blog.Josh AllmanNamed author of the Huntress threat advisory.Josh KiriakoffAcknowledged for contributions to the research and blog.Lindsey O'Donnell-WelchAcknowledged for contributions to the research and blog.Olly MaxwellAcknowledged for contributions to the research and blog.Ryan DowdAcknowledged for contributions to the research and blog.
Malware
LockBitIn some incidents, threat actors have used the compromised Bomgar instances to deploy the LockBit ransomware.PoisonKillerThe latter (PoisonX.sys) may be linked to PoisonKiller, a Bring Your Own Vulnerable Driver (BYOVD) tool designed to terminate EDR agents (the tool was likely listed on GitHub at the beginning of April, but has since
Vendors
Products
AnyDeskThreat actors have also used their access via Bomgar to conduct domain reconnaissance, perform network enumeration via NetScan, add Administrator users for persistence, and execute further RMMs like AnyDesk and Atera.AteraThreat actors have also used their access via Bomgar to conduct domain reconnaissance, perform network enumeration via NetScan, add Administrator users for persistence, and execute further RMMs like AnyDesk and Atera.BeyondTrust Privileged Remote Access25.3.2 of Bomgar/Remote Support (versions 25.3.1 and prior are impacted) and version 25.1 of Privileged Remote Access (versions 24.3.4 and prior are impacted).BeyondTrust Remote SupportOn February 6, 2026, BeyondTrust issued fixes for the flaw in Bomgar (rebranded as BeyondTrust Remote Support), which could be exploited by an unauthenticated attacker to remotely execute code.BomgarHomeBlogThreat Advisory: Uptick in Bomgar RMM ExploitationScreenConnectUtilizing a ScreenConnect remote access client as an additional persistence mechanism in the targeted environment (which was seen with C:\Program Files (x86)\ScreenConnect Client (0a42c9161c039ecc)\)SimpleHelpHere, a renamed SimpleHelp RMM was dropped onto the system, which was executed out of the PerfLogs directory (c:\PerfLogs\InputUpdate.exe) and configured to the IP address 146.70.41[.]131.
Tools
HRSwordThe SOC also observed the actor using HRSword.exe, which is legitimate software abused by cybercriminals to bypass security defenses.netscanThreat actors have also used their access via Bomgar to conduct domain reconnaissance, perform network enumeration via NetScan, add Administrator users for persistence, and execute further RMMs like AnyDesk and Atera.