Skip to content

Back to the catalog

Uptick in Bomgar RMM Exploitation
huntress.comwriteup

Uptick in Bomgar RMM Exploitation

Huntress SOC documents an ongoing wave of exploitation of CVE-2026-1731, an unauthenticated RCE in Bomgar (rebranded BeyondTrust Remote Support/Privileged Remote Access), first disclosed in February 2026 and patched in versions 25.3.2/25.1. Attackers are using compromised outdated Bomgar instances — including at an MSP and a dental software vendor — to add rogue domain admin accounts, deploy LockBit ransomware (likely via a leaked LockBit 3.0 builder), drop the BYOVD EDR-killer PoisonKiller, and pivot to additional RMM tools like AnyDesk, Atera, ScreenConnect, and a renamed SimpleHelp for persistence across downstream customer environments.

TL;DR Huntress details active exploitation of CVE-2026-1731 in Bomgar RMM leading to domain admin takeover, LockBit ransomware, and downstream MSP compromise chains.
Open original ↗
Document

What it is

Huntress SOC's report on active exploitation of Bomgar (BeyondTrust Remote Support) RMM instances via CVE-2026-1731, an unauthenticated RCE flaw BeyondTrust fixed on February 6, 2026. Exploitation came in waves: an initial spike from February 12 (≥10 organizations) and a second surge from April 3 onward. Attacks lead to LockBit ransomware deployment, persistence, and EDR kills. Root cause is not confirmed but the incidents likely stem from CVE-2026-1731 — impacted orgs were running outdated Bomgar versions.

How it works

Malicious activity spawns from bomgar-scc.exe on the compromised instance. Post-access, the actor conducts domain recon and network enumeration (NetScan), creates a local account, then elevates it into Local Administrators and Domain Admins for a domain-wide backdoor. Additional RMMs are dropped for redundant persistence: AnyDesk (C:\Users\support\Documents\AnyDesk.exe) and a ScreenConnect client under C:\Program Files (x86)\ScreenConnect Client (0a42c9161c039ecc)\. Ransomware runs as LB3.exe from the user Desktop, targeting local drives and the SQL Server install path. In one incident the actor deployed BYOVD drivers C:\temp\PoisonX.sys (possibly PoisonKiller, briefly on GitHub in early April, now removed) and C:\Windows\System32\drivers\hrwfpdrv.sys, plus HRSword.exe, to kill EDR.

Preconditions / Affected

Internet-reachable, outdated Bomgar / BeyondTrust Remote Support instances unpatched against CVE-2026-1731. The blast radius is amplified for MSPs and software vendors: one MSP compromise (April 15) triggered mass isolation of 78 businesses with exploitation across four downstream customers; a dental-software company's instance (April 14) reached three downstream companies.

What to do

Patch to a fixed Bomgar version (fixes issued February 6, 2026). Hunt for the observed indicators:

  • Child processes of bomgar-scc.exe.
  • Persistence account creation, e.g. credential Adminpwd123.1 and:
net localgroup administrators [REDACTED] /add
net group "domain admins" [REDACTED] /add
  • Unexpected AnyDesk / Atera / ScreenConnect installs (paths above).
  • Driver files PoisonX.sys, hrwfpdrv.sys, and HRSword.exe.
  • LB3.exe execution from user Desktop.

Caveats

Huntress states it does not yet have insight into the specific root cause; the CVE-2026-1731 link is assessed as likely, not confirmed. LockBit attribution is inferred from clues suggesting use of the leaked LockBit 3.0 builder — and the ransom notes in the April 12 and April 9 incidents did not match LockBit's usual style, so the operator may not be genuine LockBit. The PoisonKiller association for PoisonX.sys is tentative ("may be linked").

Organisations named here

  • LockBit 3.0
  • PoisonKiller
  • WDAGUtilityAccount

CVEs named here

  • CVE-2026-1731

Technologies named here

  • Bomgar RMM / BeyondTrust Remote Support
  • Bomgar / BeyondTrust Remote Support
  • BeyondTrust Privileged Remote Access
  • LB3.exe
  • ScreenConnect
  • AnyDesk
  • Atera
  • NetScan
  • PoisonX.sys / PoisonKiller
  • HRSword.exe
  • SimpleHelp RMM
  • LOLRMM
  • Huntress agent
  • Bomgar
  • SimpleHelp
  • Windows
  • HRSword

Techniques named here

  • Targeting MSPs to reach downstream customers
  • Local/Domain Administrator account creation for persistence
  • Deployment of additional RMM tools for persistence
  • Domain and network reconnaissance
  • BYOVD to disable EDR/security tooling
  • Ransomware execution via RMM session
  • Malicious use of Windows Installer for payload delivery
  • Dropping tools in PerfLogs directory

Threat actors named here

  • LockBit ransomware
  • Unnamed threat actors exploiting Bomgar RMM
  • LockBit

Related in Threat Intel