# Tales of Too Many RMMs

Attackers brute-forced a legacy UltraVNC install and abused MFA-less RDP to install multiple RMM tools, steal credentials, and deploy Akira ransomware.

- Payout: Real-world hack
- Severity: critical
- Program: Huntress incident response
- Analysis by: Huntress
- Disclosed: 2025-04-17
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/tales-of-too-many-rmms
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-tales-of-too-many-rmms
- Tags: area:cloud domain:infra impact:data-leak impact:funds-loss impact:rce kind:incident platform:threat-intel sev:critical technique:default-creds technique:legacy-endpoint vuln:auth-bypass vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoints with UltraVNC, RDP, and RMM tools
**Root cause:** Internet-exposed legacy UltraVNC with weak passwords and RDP enabled without MFA allowed attackers to gain and retain remote access.
**Steps:**
1. Brute force UltraVNC logins (2,189 failed attempts) until a successful session
2. From UltraVNC session run `"C:\Windows\System32\msiexec.exe" /i "C:\Users\<user>\Music\setup.msi"` to install AteraAgent
3. Launch `C:\Windows\TEMP\unpack\setup.msi` to install SplashTop Streamer
4. Log in to SplashTop Streamer, transfer files, run mimikatz and XenArmor browser password recovery
5. In second incident, access endpoint via RDP without MFA, run netscan to enumerate hosts
6. Install Chrome Remote Desktop Host, RustDesk, and AnyDesk in succession
7. Run `C:\Users\<user>\AppData\Local\Temp\AVDefenderUninstall.bat` to remove security tools
8. Deploy Akira via `win_locker.exe -remote -n=3 -p=\\192.168.x.x\C$`
**How found:** Huntress SOC correlated UltraVNC logon events, MsiInstaller telemetry, and EDR data to reconstruct the intrusion timeline.
**Exploitation:** Attackers used brute-forced UltraVNC credentials and unauthenticated RDP to install legitimate RMM tools (AteraAgent, SplashTop, Chrome Remote Desktop, RustDesk, AnyDesk) for persistence, then ran credential theft and defense evasion before deploying Akira ransomware.
**Escalation:** Pivoted from a single compromised endpoint to lateral RDP movement across the network, then to ransomware deployment on file shares.
**Insight:** Legacy RMM tools left installed after MSP changes are high-value initial access vectors; check for brute-force patterns against VNC and audit for multiple concurrent RMM installations as a persistence signal.

## Proof of concept (copied exactly from the original report)

**AteraAgent MSI install command line**

```
"C:\Windows\System32\msiexec.exe" /i "C:\Users\<user>\Music\setup.msi"
```

**Akira ransomware launch command**

```
win_locker.exe -remote -n=3 -p=\\192.168.x.x\C$
```