Full Report
The Huntress SOC has seen a recent uptick in incidents involving compromised Bomgar remote monitoring and management (RMM) instances.
Analysis Summary
# Incident Report: Exploitation of Bomgar RMM Instances (CVE-2026-1731)
## Executive Summary
The Huntress SOC has identified a significant uptick in the exploitation of compromised Bomgar (BeyondTrust Remote Support) RMM instances, likely leveraging CVE-2026-1731. Attackers are utilizing these high-privilege management tools to move laterally into downstream customer environments, deploy additional remote access tools, and execute LockBit ransomware. The campaign has resulted in mass isolations of managed service provider (MSP) clients and widespread operational disruption.
## Incident Details
- **Discovery Date:** April 3, 2026 (Recent uptick)
- **Incident Date:** February 2026 – April 2026
- **Affected Organization:** Multiple, including a dental software company and a Managed Service Provider (MSP).
- **Sector:** Technology/Software, Healthcare (Dental), Managed Services.
- **Geography:** Global (Impacted organizations typically manage multiple downstream clients).
## Timeline of Events
### Initial Access
- **Date/Time:** February 6, 2026 (Vulnerability Disclosure); February 12 (Initial spike); April 3 (Second uptick).
- **Vector:** Exploitation of unauthenticated Remote Code Execution (RCE) flaw in outdated Bomgar instances (CVE-2026-1731).
- **Details:** Attackers targeted `bomgar-scc.exe` processes on unpatched servers.
### Lateral Movement
- **MSP/Supply Chain Pivot:** Attackers used MSP-level Bomgar access to jump to downstream client Domain Controllers.
- **Credential Escalation:** Creation of local accounts (e.g., "Adminpwd123.1") subsequently added to the "Domain Admins" group.
- **Tool Deployment:** Installation of secondary RMMs such as AnyDesk and Atera to maintain access outside the primary Bomgar environment.
### Data Exfiltration/Impact
- **Ransomware:** Deployment of LockBit 3.0 (likely via the leaked builder).
- **Service Disruption:** One incident led to the mass isolation of 78 businesses to prevent further spread.
- **Scope:** At least 10 organizations in February; dozens of downstream victims in April.
### Detection & Response
- **Discovery:** Huntress SOC observed malicious child processes spawning from `bomgar-scc.exe`.
- **Response Actions:** Mass isolation of affected hosts, forensic analysis of RMM logs, and notification to affected downstream customers.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2026-1731 (RCE in BeyondTrust/Bomgar).
- **Persistence:** Creation of new administrative user accounts and installation of secondary RMMs (AnyDesk, Atera, Tiflux).
- **Privilege Escalation:** Adding unauthorized users to Local Administrators and Domain Admins groups.
- **Defense Evasion:** Utilizing legitimate RMM software (Living-off-the-Land) to blend with normal administrative traffic.
- **Credential Access:** Likely credential harvesting from compromised RMM databases or memory.
- **Discovery:** Domain reconnaissance and network enumeration using tools like NetScan.
- **Lateral Movement:** RMM-based pivoting from service providers to client environments.
- **Collection:** (Details not specified in brief, but typical of LockBit).
- **Exfiltration:** (Details not specified in brief).
- **Impact:** Ransomware encryption (LockBit 3.0) and unauthorized remote control.
## Impact Assessment
- **Financial:** High (Ransomware demands and recovery costs for 78+ businesses).
- **Data Breach:** Likely, given the deployment of LockBit 3.0.
- **Operational:** Critical (Mass isolation of an MSP's entire client base).
- **Reputational:** Significant (Supply chain compromise affecting downstream dental and MSP clients).
## Indicators of Compromise
- **Network:** Connections to AnyDesk and Atera infrastructure from unauthorized hosts.
- **File:** `bomgar-scc.exe` (as a parent process for malicious shells); `C:\Users\support\Documents\AnyDesk.exe`.
- **Behavioral:** Unexpected creation of users with passwords like "Adminpwd123.1"; execution of NetScan on Domain Controllers.
## Response Actions
- **Containment:** Host isolation via Huntress/EDR platforms.
- **Eradication:** Patching Bomgar instances to the latest version; removal of unauthorized local and domain accounts.
- **Recovery:** Restoration of services for 78 isolated businesses after verifying clean states.
## Lessons Learned
- **Patch Management:** RMM tools are Tier-0 assets; failure to patch a critical-severity RCE (CVE-2026-1731) immediately leads to full supply chain compromise.
- **RMM Overstock:** Organizations often have "forgotten" or secondary RMM tools installed that provide a back door for attackers.
- **Account Monitoring:** Alerts for new additions to the "Domain Admins" group remain one of the most effective detection points.
## Recommendations
1. **Immediate Patching:** Update BeyondTrust (Bomgar) Remote Support to the latest version immediately.
2. **Audit RMM Tools:** Inventory and remove unauthorized or redundant RMM tools (AnyDesk, Atera, etc.).
3. **MFA Enforce:** Ensure Multi-Factor Authentication is enforced on all RMM logins.
4. **Least Privilege:** Restrict RMM service accounts from having permanent Domain Admin rights unless actively performing a task.