Full Report
Four years after the Kaseya supply chain attack, a recent incident shows how threat actors still successfully target MSPs’ downstream customers through RMM software.
Analysis Summary
# Best Practices: Securing RMM Platforms Against Supply Chain Attacks
## Overview
These practices address the critical risks associated with Remote Monitoring and Management (RMM) software. Because RMMs possess high-level privileges (SYSTEM) across multiple downstream client environments, they are primary targets for threat actors seeking to perform "bulk attacks"—leveraging one compromise to deploy ransomware or persistence mechanisms across hundreds of businesses simultaneously.
## Key Recommendations
### Immediate Actions
1. **Enforce Mandatory MFA:** Ensure Multi-Factor Authentication is non-negotiable for every user account within the RMM portal.
2. **Audit Local Admin Groups:** Scan all managed endpoints for unauthorized local administrator accounts (e.g., check for suspicious names like `msoit`, `se91`, `veean`).
3. **Terminate Unauthorized Tunnels:** Search for and terminate unauthorized instances of `cloudflared.exe` or `Visual Studio Code` tunnels, which are currently being used for persistent remote access.
4. **Isolate Compromised Endpoints:** If an RMM agent shows suspicious `net.exe` activity (adding users), immediately isolate the host from the network.
### Short-term Improvements (1-3 months)
1. **Review RMM Permissions:** Implement Least Privilege by restricting which technicians can run scripts or "Interactive Commands" (like `AgentPackageRunCommandInteractive.exe`).
2. **Alerting on Binary Execution:** Configure EDR/MDR alerts for common RMM-abused binaries, specifically `net.exe` or `net1.exe` when spawned by an RMM agent process (e.g., `AteraAgent.exe`).
3. **Credential Hygiene:** Enforce a policy prohibiting the reuse of passwords across different customer environments.
### Long-term Strategy (3+ months)
1. **RMM Consolidation:** Audit the environment for "Shadow RMMs." Huntress findings suggest threat actors often install secondary RMMs (e.g., Bomgar, ScreenConnect) to maintain access if the primary one is secured.
2. **Zero Trust Architecture:** Transition to a model where RMM access requires validated device posture and Just-In-Time (JIT) administrative elevations.
3. **Supply Chain Incident Response:** Develop and drill a specific playbook for "MSP Vendor Compromise" scenarios.
## Implementation Guidance
### For Small Organizations
- **Standardize:** Use only one RMM tool; remove any legacy or "one-off" agents from endpoints.
- **Outsource Monitoring:** Use a Managed Detection and Response (MDR) provider to monitor RMM process behavior, as internal teams rarely have 24/7 coverage.
### For Medium Organizations
- **Script Signing:** Enable requirements that any script deployed via RMM must be digitally signed by an authorized administrator.
- **Egress Filtering:** Block outbound connections to known tunneling service domains (e.g., Cloudflare Tunnel endpoints) unless explicitly required for business.
### For Large Enterprises
- **API Monitoring:** Monitor RMM logs via API for unusual login locations or bulk script deployments.
- **Service Account Hardening:** Transition RMM service accounts to Managed Service Accounts (MSAs) where possible to prevent credential harvesting.
## Configuration Examples
**Process Monitoring Rule:**
Detect when a privileged RMM agent executes local group modifications.
* **Parent Process:** `AteraAgent.exe` OR `VSA.exe` OR `ScreenConnect.Service.exe`
* **Child Process:** `net.exe` OR `net1.exe`
* **Command Line Includes:** `user /add` OR `localgroup administrators /add`
**Tunnel Detection:**
* **Process Name:** `cloudflared.exe`
* **Command Line:** `*tunnel*run*--token*`
## Compliance Alignment
- **NIST CSF (PR.AC-4):** Managing access permissions and facilitating remote access.
- **CIS Control 4 & 5:** Inventory and Control of Software Assets / Account Management.
- **ISO 27001 (A.9.4.4):** Use of privileged utility programs.
## Common Pitfalls to Avoid
- **Partial MFA:** Only protecting the "Admin" account while leaving "Technician" accounts with SMS or no MFA.
- **Ignoring "SYSTEM" Alerts:** Dismissing alerts because they originated from a "trusted" RMM agent.
- **Visibility Gaps:** Having RMM agents installed on endpoints that do not have active security monitoring (EDR/MDR) installed.
## Resources
- **Huntress Blog (Threat Intel):** `huntress[.]com/blog`
- **CISA Guide on Securing MSPs:** `cisa[.]gov/resources-tools/resources/protecting-managed-service-providers`
- **MITRE ATT&CK - Trusted Relationship (T1199):** `attack[.]mitre[.]org/techniques/T1199/`