Loading story…
Huntress reported an intrusion in which a threat actor used stolen SSLVPN credentials to access a partner environment through a FortiGate from 45.153.34[.]132, then moved laterally with a customized Impacket smbexec.py workflow to a workstation and enabled RDP. After Microsoft Defender blocked a registry-hive dumping attempt as Behavior:Win32/RegDump.SA, the operator shifted from SMB-based execution to an interactive RDP session from VPN-assigned IP 10.212.134[.]200.
The attacker then installed the open-source Komari monitoring agent from raw.githubusercontent[.]com as a SYSTEM service named "Windows Update Service", using NSSM for persistence and embedding the C2 server and bearer token in service parameters. Huntress said Komari's normal feature set effectively provides command-and-control by default, including arbitrary command execution, interactive terminal access, network probing, and a persistent WebSocket channel; responders isolated affected devices, disabled the compromised account, and cut off the WebSocket connection before the actor issued follow-on commands through the tool.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-16, Huntress published its report assessing Komari as effectively functioning as command-and-control by default because it supports arbitrary command execution, interactive terminal access, and network probing over persistent WebSocket connections.
Huntress isolated affected devices in the partner environment, disabled the compromised user account, and severed the persistence/WebSocket connection before the operator issued any follow-on exec or terminal commands through Komari.
The attacker configured Komari persistence using NSSM and hardcoded the command server and bearer token into service parameters, establishing a long-lived outbound WebSocket channel that would provide SYSTEM-level remote access.
Following the Defender detection, the operator moved to an interactive RDP session and installed the open-source Komari monitoring agent from raw.githubusercontent[.]com as a SYSTEM-level service named "Windows Update Service."
During the intrusion, Microsoft Defender quarantined a registry hive dumping artifact and detected it as Behavior:Win32/RegDump.SA, interrupting the attacker's initial activity.
After gaining access, the attacker used a customized Impacket smbexec.py workflow over SMB to pivot to a workstation and enable Remote Desktop Protocol access.
On 2026-04-16, a threat actor used stolen SSLVPN credentials for a user to access a partner environment through a FortiGate device from IP address 45.153.34[.]132.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026
Attackers leveraged trusted remote management software in two separate supply chain intrusions, including a ransomware case tied to **Kaseya VSA** and a credential-dumping operation delivered through a **Desktop Central** agent. In the Kaseya-linked incident, the intrusion chain used the Kaseya agent to create and decode malicious payloads, attempted to disable Microsoft Defender protections, and dropped ransomware-related components including `agent.exe` and `MsMpEng.exe`. In the second intrusion, the attackers used the Desktop Central agent to gain footholds, established persistence with scheduled tasks, forwarded traffic with **GO Simple Tunnel**, and deployed `setup0.exe` alongside `elevateutils.exe`, which analysis identified as a **Cobalt Strike Beacon** Malleable C2 stager communicating with `vmware[.]center`. Investigators contained the activity through root-cause analysis, IOC hunting, and endpoint isolation, underscoring how centralized management platforms can become high-impact supply chain attack vectors if not closely monitored and hardened.
Aug 14, 2026