Full Report
When a threat actor exploited an MSP's RMM tool to target businesses, Huntress investigated and uncovered another eerily similar incident with key differences that reveal evolving tactics
Analysis Summary
# Incident Report: MSP RMM Exploitation and Akira Ransomware Deployment
## Executive Summary
A threat actor compromised a Managed Service Provider’s (MSP) Atera RMM instance to launch downstream attacks against its customer base. The attackers utilized Cloudflare tunnels for persistent remote access and successfully deployed Akira ransomware on several endpoints. Huntress intervention mid-compromise prevented further spread to additional customers, though some operational disruption occurred due to encryption.
## Incident Details
- **Discovery Date:** June 24, 2025 (approximate, based on Huntress agent deployment)
- **Incident Date:** June 23 – June 25, 2025
- **Affected Organization:** Not Disclosed (MSP and four identified downstream entities)
- **Sector:** Managed Service Provider / Multiple SMBs
- **Geography:** Not Disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** June 23, 2025
- **Vector:** Compromised RMM Tool
- **Details:** The threat actor gained unauthorized access to the MSP’s Atera RMM instance, allowing them to execute commands on downstream customer endpoints without traditional perimeter authentication.
### Lateral Movement
- **Details:** Attackers moved from the RMM console to specific customer endpoints, creating local accounts (e.g., account name `bck`) and utilizing RDP for manual navigation across the network.
### Data Exfiltration/Impact
- **Details:** Akira ransomware was successfully deployed and executed on multiple endpoints, leading to data encryption. The extent of data exfiltration was not explicitly detailed, but the primary impact was operational disruption through encryption.
### Detection & Response
- **Discovery:** Managed Antivirus (MAV) alerts for Akira ransomware and subsequent deployment of the Huntress agent mid-incident.
- **Response Actions:** The Huntress SOC isolated impacted endpoints, identified the shared Cloudflare tunnel tokens, and coordinated with the MSP to secure the Atera RMM instance.
## Attack Methodology
- **Initial Access:** Exploitation of MSP RMM (Atera).
- **Persistence:** Installation of Cloudflare tunnels (`cloudflared.exe`) and creation of a new local user account (`bck`).
- **Privilege Escalation:** Likely achieved via RMM agent SYSTEM privileges to create administrative accounts.
- **Defense Evasion:** Attempted disabling of Windows Defender after initial ransomware detections.
- **Credential Access:** Utilization of RMM-stored credentials or local account creation.
- **Discovery:** RMM-based reconnaissance of the MSP's customer list.
- **Lateral Movement:** RDP and RMM remote command execution.
- **Collection:** (Not detailed in text).
- **Exfiltration:** Potential use of Cloudflare tunnels as a covert channel.
- **Impact:** Deployment of Akira ransomware for data encryption.
## Impact Assessment
- **Financial:** High (Cleanup costs, potential ransom demands, and MSP liability).
- **Data Breach:** Confirmed encryption; potential exfiltration of sensitive client data.
- **Operational:** Severe disruption for the MSP and three customers due to encrypted systems.
- **Reputational:** High risk to the MSP’s "Trusted Provider" status.
## Indicators of Compromise
- **Network:** Cloudflare tunnel traffic (associated with specific redacted tokens).
- **File:** `cloudflared.exe`, Akira ransomware binaries (detected by MAV).
- **Behavioral:** Unauthorized creation of user account `bck`; execution of `cloudflared.exe tunnel run --token [REDACTED]`; disabling of Windows Defender.
## Response Actions
- **Containment:** Host isolation of infected endpoints.
- **Eradication:** Removal of the `bck` account, termination of Cloudflare tunnel services, and RMM credential rotation.
- **Recovery:** Restoration of files from backups for impacted customers.
## Lessons Learned
- **RMM as a Force Multiplier:** Threat actors are increasingly using "one-to-many" tools like RMMs to bypass perimeter defenses of multiple companies simultaneously.
- **Visibility Gaps:** The lack of EDR telemetry prior to the Huntress installation hampered the initial investigation, highlighting the need for pre-existing continuous monitoring.
- **Shared Infrastructure:** The reuse of Cloudflare tunnel tokens across different victims allowed for faster correlation of the threat actor's activity.
## Recommendations
- **MFA Enforcement:** Mandate Multi-Factor Authentication for all RMM user accounts and administrative portals.
- **Least Privilege:** Limit RMM permissions to only necessary technician accounts and use "Just-in-Time" access where possible.
- **Egress Filtering:** Restrict or monitor the use of unauthorized tunneling tools like Cloudflare (cloudflared), Ngrok, or Tailscale within the environment.
- **Active Monitoring:** Implement 24/7 SOC monitoring to detect anomalous RMM activity, such as bulk script execution or new service creation.