Huntress Details Attacks Using Multiple RMM Tools, Including Akira Ransomware Deployment
Summary
Huntress reconstructs two incidents involving abused or attacker-installed RMM tools, including one ending in Akira ransomware. It recommends asset inventory, attack-surface reduction, and endpoint monitoring.
Key points
- In one incident, attackers accessed an endpoint through a legacy UltraVNC installation, then installed AteraAgent and SplashTop Streamer.
- Huntress logs showed 2,189 failed UltraVNC login attempts; after a successful SplashTop login, attackers transferred files and ran credential-theft tools, including Mimikatz.
- In a separate incident, an endpoint lacking MFA on RDP was accessed before Akira ransomware was deployed.
- The attacker moved laterally over RDP and rapidly installed Chrome Remote Desktop Host, RustDesk, and AnyDesk.
- Huntress telemetry indicated attempts to remove security tools before the Akira ransomware was launched.
- The article recommends maintaining an accurate inventory of assets and applications, reducing attack surface, and ensuring endpoint monitoring coverage.
Article Details
- Attack Vectors
- Access through a legacy RMM tool that remained in place after a business moved to a new managed service provider.
- Brute-force password guessing against UltraVNC, with logs showing 2,189 failed login attempts from various public IP addresses before successful logins.
- Remote access through RDP that was not protected by MFA, followed by lateral movement between endpoints via RDP.
- Access to endpoints via SMB/RPC or an MSSQL instance to enable RDP or install additional RMM tools.
- Installation of additional RMM tools, including cases where multiple tools were installed in rapid succession.
- Akira ransomware execution with a command targeting a network share.
- Defensive Notes
- Maintain an accurate inventory of physical and virtual assets and the applications expected to run on them.
- Reduce the attack surface by configuring systems for their business use and disabling unnecessary default behavior.
- Install EDR and comparable monitoring tools across all endpoints to avoid coverage gaps.
- Protect RDP with MFA and review which systems and users can access it.
- Review legacy and concurrently used RMM tools, and examine their logs to establish expected usage and investigate suspicious activity.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article reports that mimikatz, described as a credential theft tool, was run during the incident.T1021.001 · Remote Desktop ProtocolThe threat actor accessed endpoints and moved laterally between endpoints using RDP.T1046 · Network Service DiscoveryThe threat actor ran netscan to enumerate endpoints on the network.T1110.001 · Password GuessingThe article reports password-guessing attacks against UltraVNC, including 2,189 failed login attempts.T1219 · Remote Access ToolsThreat actors installed and used RMM tools, including AteraAgent, SplashTop Streamer, Chrome Remote Desktop Host, RustDesk, and AnyDesk, for remote access.T1486 · Data Encrypted for ImpactAkira ransomware was deployed and launched against the endpoint.T1562.001 · Disable or Modify ToolsA batch file appeared to attempt removal of security tools, and the investigation found that several attempts succeeded.
Malware
Products
AnyDeskThe threat actor moved laterally between the endpoints via RDP, and within minutes of accessing the reported endpoint, installed the Chrome Remote Desktop Host, RustDesk, and AnyDesk, all in rapid succession.AteraAgenthowever, the investigative timeline illustrated that during that timeframe, the threat actor installed AteraAgent via the following command line:Chrome Remote Desktop HostThe threat actor moved laterally between the endpoints via RDP, and within minutes of accessing the reported endpoint, installed the Chrome Remote Desktop Host, RustDesk, and AnyDesk, all in rapid succession.Mesh AgentHuntress analysts have observed incidents where threat actors have used various means to install RMM tools such as SimpleHelp or Mesh Agent.RustDeskThe threat actor moved laterally between the endpoints via RDP, and within minutes of accessing the reported endpoint, installed the Chrome Remote Desktop Host, RustDesk, and AnyDesk, all in rapid succession.SimpleHelpHuntress analysts have observed incidents where threat actors have used various means to install RMM tools such as SimpleHelp or Mesh Agent.SplashtopShortly after the installation was completed, the file C:\Windows\TEMP\unpack\setup.msi was launched, successfully installing SplashTop Streamer.UltraVNCDuring an incident identified on 7 Feb 2025, evidence indicated that UltraVNC had been installed on 14 May 2023, and that since that time, it had been subject to brute force password guessing attacks.XenArmorendpoint via that connection, and several credential theft tools were run, including mimikatz and the XenArmor browser password recovery tool.
Tools
Mimikatzto the compromised endpoint via that connection, and several credential theft tools were run, including mimikatz and the XenArmor browser password recovery tool.netscanAn investigation into the incident indicated that three days prior to the incident, a threat actor had accessed the endpoint via RDP that was not protected via MFA, and ran netscan to enumerate endpoints on the network.