Threat Advisory: Uptick in Bomgar RMM Exploitation
Huntress has observed an uptick in threat actors exploiting CVE-2026-1731 in outdated Bomgar RMM instances to compromise organizations and their downstream clients. Attackers utilize this access to establish persistence via secondary RMM tools, evade defenses using BYOVD techniques, and ultimately deploy LockBit ransomware.
- sha2563529b1422da886b7d04555340dfb1efd44a625c2921af6df39819397176956d6LB3.exe - LockBit ransomware executable observed in April 14 incident
- sha256538b3b36dd8a30e721cc8dc579098e984cf8ed30b71d55303db45c7344f7a4cfLB3.exe - LockBit ransomware executable observed in April 12 incident
- sha256a5035cbd6c31616288aa66d98e5a25441ee38651fb5f330676319f921bb816a4PoisonX.sys - BYOVD driver used to terminate EDR agents
- sha256b44dd12179a15a7d89c18444d36e8d70b51d30c7989d3ab71330061401f731feHRSword.exe - Defense evasion tool used to bypass security defenses
- sha256bc9635dcc3444c18b447883c6bc1931e5373e48c7dbfaa607285a9fb668b03eaInputUpdate.exe - Renamed SimpleHelp RMM dropped for persistence
Key Takeaways
- Threat actors are actively exploiting CVE-2026-1731 in outdated Bomgar (BeyondTrust) RMM instances to gain initial access.
- Attackers are targeting MSPs and software vendors to compromise downstream customers and deploy LockBit ransomware.
- Persistence is established by creating local/domain admin accounts and deploying secondary RMM tools like AnyDesk, Atera, and ScreenConnect.
- Defense evasion tactics include using BYOVD tools (PoisonX.sys) and HRSword to terminate EDR agents.
Affected Systems
- Bomgar / BeyondTrust Remote Support (versions 25.3.1 and prior)
- Bomgar / BeyondTrust Privileged Remote Access (versions 24.3.4 and prior)
Vulnerabilities (CVEs)
- CVE-2026-1731
Attack Chain
Threat actors exploit CVE-2026-1731 in outdated Bomgar RMM instances to gain initial access, often targeting MSPs to reach downstream clients. Once inside, they perform network reconnaissance using tools like NetScan and nltest.exe. Persistence is established by creating or modifying local and domain administrator accounts, and by deploying secondary RMM tools such as AnyDesk, Atera, and ScreenConnect. The attackers then evade defenses using BYOVD techniques (PoisonX.sys) and HRSword before finally deploying LockBit ransomware (LB3.exe) to encrypt the network.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide explicit detection rules, but outlines behavioral indicators, file paths, and process ancestry patterns suitable for threat hunting.
Detection Engineering Assessment
EDR Visibility: High — EDR solutions can easily monitor process ancestry (e.g., bomgar-scc.exe spawning cmd.exe or net.exe), driver loads (BYOVD), and the execution of known ransomware binaries. Network Visibility: Medium — Network visibility can detect secondary RMM tool traffic (AnyDesk, Atera) and C2 communications, though initial exploitation occurs over the legitimate Bomgar channel. Detection Difficulty: Moderate — While the ransomware and BYOVD tools are easily detected, the initial access and persistence via legitimate RMM tools blend in with normal administrative activity, requiring behavioral correlation.
Required Log Sources
- Windows Security Event Log (Event ID 4720, 4728, 4732)
- Sysmon Event ID 1 (Process Creation)
- Sysmon Event ID 6 (Driver Loaded)
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for bomgar-scc.exe spawning suspicious child processes like cmd.exe, net.exe, or msiexec.exe. | Process Creation (Sysmon Event ID 1 / EDR telemetry) | Execution | Low to Medium (Bomgar may occasionally run scripts, but spawning net.exe to add admins is highly suspicious) |
| Identify the creation of new local or domain administrator accounts occurring shortly after an active Bomgar session. | Windows Security Event Logs (4720, 4728, 4732) | Persistence | Medium (Legitimate admins may create accounts, but correlation with Bomgar activity narrows it down) |
| Detect the installation or execution of secondary RMM tools (AnyDesk, Atera, ScreenConnect) from unusual directories like C:\PerfLogs. | Process Creation, File Creation | Persistence | Low (Legitimate RMMs are rarely installed from PerfLogs) |
Control Gaps
- Lack of strict application control allowing unauthorized RMMs
- Insufficient monitoring of built-in accounts like WDAGUtilityAccount
Key Behavioral Indicators
- bomgar-scc.exe spawning net.exe
- msiexec.exe running from C:\PerfLogs\
- Unexpected driver loads in C:\temp\
False Positive Assessment
- Medium. Legitimate administrative actions via Bomgar (like running scripts or installing software) may trigger behavioral alerts, requiring baseline comparisons.
Recommendations
Immediate Mitigation
- Apply patches for CVE-2026-1731 (Remote Support 25.3.2+, Privileged Remote Access 25.1+).
- Isolate compromised Bomgar instances and affected downstream environments.
Infrastructure Hardening
- Audit and restrict the use of RMM tools using application control.
- Monitor and restrict modifications to Local Administrators and Domain Administrators groups.
User Protection
- Deploy EDR to monitor for BYOVD techniques and unauthorized driver loads.
- Reset passwords for any compromised accounts, including built-in accounts like WDAGUtilityAccount.
Security Awareness
- Train SOC analysts to recognize the abuse of legitimate RMM tools (LOLRMM) as persistence mechanisms.
MITRE ATT&CK Mapping
- T1190 - Exploit Public-Facing Application
- T1078.001 - Valid Accounts: Default Accounts
- T1078.002 - Valid Accounts: Domain Accounts
- T1078.003 - Valid Accounts: Local Accounts
- T1136.001 - Create Account: Local Account
- T1136.002 - Create Account: Domain Account
- T1098 - Account Manipulation
- T1219 - Remote Access Software
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1069.001 - Permission Groups Discovery: Local Groups
- T1069.002 - Permission Groups Discovery: Domain Groups
- T1486 - Data Encrypted for Impact
Additional IOCs
- Ips:
146[.]70[.]41[[.]]131- IP configured for SimpleHelp RMM
- File Hashes:
538b3b36dd8a30e721cc8dc579098e984cf8ed30b71d55303db45c7344f7a4cf(SHA256) - LB3.exe3529b1422da886b7d04555340dfb1efd44a625c2921af6df39819397176956d6(SHA256) - LB3.exebc9635dcc3444c18b447883c6bc1931e5373e48c7dbfaa607285a9fb668b03ea(SHA256) - InputUpdate.exeb44dd12179a15a7d89c18444d36e8d70b51d30c7989d3ab71330061401f731fe(SHA256) - HRSword.exea5035cbd6c31616288aa66d98e5a25441ee38651fb5f330676319f921bb816a4(SHA256) - PoisonX.sys
- File Paths:
C:\Users\support\Documents\AnyDesk.exe- Path used to drop AnyDesk for persistenceC:\Program Files (x86)\ScreenConnect Client (0a42c9161c039ecc)\- Path associated with ScreenConnect persistenceC:\Windows\System32\drivers\hrwfpdrv.sys- Suspicious driver dropped for defense evasionC:\temp\PoisonX.sys- BYOVD driver dropped for defense evasionC:\Program Files (x86)\AnyDesk- Installation directory for AnyDeskC:\PerfLogs\setup.msi- Atera RMM installer dropped in PerfLogsc:\PerfLogs\InputUpdate.exe- Renamed SimpleHelp RMM dropped in PerfLogs
- Command Lines:
- Purpose: Create new local user account | Tools:
net.exe| Stage: Persistence |net user - Purpose: Add user to local administrators group | Tools:
net.exe,net1.exe| Stage: Privilege Escalation |net localgroup administrators - Purpose: Add user to domain admins group | Tools:
net.exe| Stage: Privilege Escalation |net group "domain admins" - Purpose: Install secondary RMM tool (AnyDesk) | Tools:
anydesk.exe| Stage: Persistence |anydesk.exe --install - Purpose: Execute MSI installer from suspicious directory | Tools:
msiexec.exe| Stage: Execution |msiexec.exe /i C:\PerfLogs\
- Purpose: Create new local user account | Tools:
- Other:
Adminpwd123.1- Password used by attacker for created accounts123123qwEqwE- Password used by attacker for WDAGUtilityAccountlokbt9@onionmail[.]org- Email address found in LockBit ransom noteWDAGUtilityAccount- Built-in account compromised and added to Admin/RDP groupsAteraAgentServiceWatchdog- Scheduled task created for Atera persistencebomgar-scc.exe- Legitimate Bomgar process abused to spawn malicious child processes
