Hijacked: How Cyber Criminals Are Exploiting Remote Monitoring Tools(RMM) to Launch Attacks

Key Highlights:

• Widespread Exploitation: Proofpoint’s latest report highlights how Iranian threat actors leverage Remote Monitoring and Management (RMM) platforms like Atera to usurp control over system functionalities, facilitating data theft, configuration changes, and the deployment of malware.
• Persisting Threat: Historical advisories and current incidents underscore a continuous pattern of RMMs being manipulated as conduits for cyberattacks, signaling a crucial need for enhanced defensive strategies and ongoing vigilance.
• Preventive Measures: We detail practical steps that Managed Service Providers (MSPs) and their clients can take to protect against the misuse of RMM tools, emphasizing the importance of multi-factor authentication and continuous security reviews.

The Growing Impact on MSPs and Their Clients

The exploitation of Remote Monitoring and Management (RMM) tools not only jeopardizes the operational integrity of MSPs but also threatens the security of their clients’ networks. RMMs are essential in MSPs’ toolkits, streamlining the delivery of services and resolution of IT issues for a wide range of clients. These platforms are equipped with advanced features such as patch management, network monitoring, direct messaging, and security protocols, extending far beyond their initial functions. Unfortunately, the very features that make RMMs indispensable to MSPs also render them prime targets for cyber attackers. These attackers capitalize on the extensive capabilities of RMMs, manipulating them for malicious purposes and compromising both provider and client security.

The Exploitation of Trust and Functionality

Cybercriminals exploit the trusted status and comprehensive access provided by RMMs to orchestrate wide-ranging attacks. A notable example is detailed in a recent report from Proofpoint, which reveals how the Iran-linked threat actor TA450 deploys a seemingly benign MSI file to install AteraAgent. This action grants them the ability to misuse RMM privileges to exfiltrate data, alter configurations, or introduce further malicious software, all while remaining undetected under the guise of legitimate RMM activity.

Historical and Persistent Security Challenges

This method of attack is not isolated. Past advisories from entities like the Cybersecurity and Infrastructure Security Agency (CISA) and reports from security firms such as eSentire highlight a troubling trend: RMMs are repeatedly used as persistent backdoors for ransomware deployment and other malicious activities. For instance, in 2023, LockBit ransomware operators exploited popular RMMs like ScreenConnect and AnyDesk, installed either by MSPs or deceitfully by the attackers themselves.

Moreover, vulnerabilities within RMM components themselves—both server-side and client-side—provide another vector for exploitation. Attacks like the “Citrix Bleed” or compromised RMM versions, such as those reported in the Zloader campaign by SentinelOne, demonstrate the multifaceted risks associated with RMM tools.

Addressing the Threat to MSPs and Their Clients

The ongoing exploitation of RMM systems underscores a critical need for MSPs and their clients to adopt stringent security measures:

1. Official Software Only: Ensure that any RMM software installed is directly obtained from official vendor websites and features proper signatures and certifications.
2. Enhanced Access Control: Implement multi-factor authentication (MFA) on all RMM servers to mitigate the risk of unauthorized access that could compromise multiple client systems.
3. Vigilant Patch Management: Regularly update and patch RMM solutions to protect against known vulnerabilities that could be exploited by attackers.
4. Permission Limitation: Restrict RMM user permissions to the minimum necessary levels, avoiding default administrative access to reduce potential damage from compromised credentials.
5. Regular Audits: Conduct frequent audits of RMM permissions and logs to identify and address any irregular activities or unauthorized access attempts, ensuring any anomalous findings are promptly investigated and mitigated.

Streamlined RMM Integration with Guardz

Effective device security relies on an admin’s ability to efficiently deploy security components to managed devices. Many IT professionals utilize RMM tools, and Guardz has developed a universally compatible integration playbook. We have created simple-to-use scripts that ensure agent deployment in just a few clicks.

This update streamlines agent deployment on devices by introducing a new playbook that features scripts for Mac, and Windows, ensuring compatibility with any RMM tool. The comprehensive playbook provides step-by-step instructions for uploading scripts to the RMM, entering the Org Key, and deploying the agent across all devices seamlessly with just a few clicks.

Conclusion

The strategic abuse of RMM platforms by cyber attackers represents a significant and evolving threat to MSPs and their clients. By understanding the methods employed by these threat actors and implementing robust preventive measures, MSPs can safeguard their operational frameworks and protect their clients from the severe repercussions of cyber attacks.