Huntress Details Akira Ransomware Attacks Abusing MSP Atera RMM Tools
Summary
Huntress linked three attacks on MSP customers to Atera RMM access, with attackers installing Cloudflare tunnels and deploying Akira ransomware on some endpoints. Log analysis connected activity across incidents.
Key points
- Huntress reported three attacks in which an MSP’s Atera RMM instance was identified as the starting point for activity on customer endpoints.
- In the June 23–25 incident, attackers installed Cloudflare tunnels and deployed Akira ransomware on some endpoints; the Huntress agent was installed after the compromise began.
- Endpoint and Atera logs showed account creation or password changes, remote logins, Windows Defender detections and disabling, and evidence associated with ransomware execution.
- Huntress analysts connected the incidents through shared Cloudflare tunnel token account IDs, workstation names, and other observed activity.
- Huntress says its SOC isolated endpoints and notified the MSP, interrupting further activity; the article does not identify the threat actors.
- The article recommends application controls for RMMs, reviewing RMM execution logs, and auditing remote-access tools for unauthorized instances.
Article Details
- Attack Vectors
- Threat actors used a compromised MSP Atera RMM instance to access the MSP's and downstream customers' endpoints.
- Cloudflare tunnels were installed on endpoints and used for brief remote connections, including RDP access.
- The actors created or modified user accounts, then used accounts such as bck and adm1 to access endpoints.
- Akira ransomware was deployed on some endpoints. On one endpoint, a PowerShell command removed Windows shadow copies.
- Windows Defender was disabled after detecting and quarantining ransomware attempts; advanced_port_scanner.exe was run to map the network.
- Defensive Notes
- Create application controls that cover RMM tools.
- Review logs for instances where RMMs were executed, and audit remote access tools for potentially unauthorized instances.
- Isolate impacted endpoints and coordinate with the MSP to interrupt activity.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe bck and adm1 accounts were used to access endpoints via RDP; some connections were over a Cloudflare tunnel.T1046 · Network Service Discoveryadvanced_port_scanner.exe was run to map the network.T1059.001 · PowerShellPowerShell ran Get-WmiObject Win32_Shadowcopy, Remove-WmiObject.T1098 · Account ManipulationThe actors changed a user account password during activity on an endpoint.T1136.001 · Local AccountThe actors created local accounts, including bck and adm1, on impacted endpoints.T1219 · Remote Access ToolsThe actors abused the MSP's Atera RMM instance to access endpoints.T1486 · Data Encrypted for ImpactAkira ransomware was successfully deployed on some endpoints.T1490 · Inhibit System RecoveryThe PowerShell command removed Windows shadow copies.T1543.003 · Windows ServiceWindows Event Logs showed a Cloudflare tunnel service being created and run through cloudflared.exe.T1562.001 · Disable or Modify ToolsWindows Defender Real-Time Protection was disabled after it detected and quarantined ransomware attempts.
Malware
Products
Atera RMMIn this attack, which played out between June 23 and 25, the threat actors also targeted the MSP’s Atera RMM instance and deployed Cloudflare tunnels, as we had seen in the previous incident.CloudflareIn this attack, which played out between June 23 and 25, the threat actors also targeted the MSP’s Atera RMM instance and deployed Cloudflare tunnels, as we had seen in the previous incident.Windows DefenderOn others, the threat actor had disabled Windows Defender after it detected and quarantined its initial attempt to deploy the ransomware.