# Rogue or default-enabled remote access agent

Outbound agent or remote-support service with exec/PTY shell enabled by default or bypassing auth

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-04-30. Updated 2026-11-03._

## How it works
A remote-access or monitoring agent is installed on a host and holds a long-lived outbound connection to a server. The agent accepts commands pushed from that server: exec, a PTY/terminal shell, file transfer, or scanning. The broken assumption is that "the server is trusted, so the agent can accept anything it sends." When the agent enables exec/terminal by default, or authenticates only with a token in a URL, anyone who controls or steals that server-side channel gets code execution on every enrolled host. The agent's own privilege (often LocalSystem via a service wrapper) becomes the attacker's privilege [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md). A second shape: a legitimate remote-support product (ScreenConnect) is already installed, and an attacker reuses the vendor's instance, a shared account, or plants a second instance that bypasses MFA [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md).

## Where it shows up
- Agents registered as SYSTEM/root services (NSSM, systemd) that open a persistent outbound WebSocket [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)
- Bearer tokens or credentials passed in URL query strings rather than headers or mTLS [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)
- Default-enabled event handlers: exec, terminal/PTY, ping, file push [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)
- Multiple instances of the same remote-support product on one host, or one pointing at a dynamic DNS domain (ddns.net) [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md)
- Shared vendor accounts and identical instance IDs across unrelated organizations [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md)
- Installers pulled from raw code-hosting URLs (raw.githubusercontent.com) [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)

## How to review
Identify every agent/service that opens an outbound channel and can receive commands. For each, confirm the invariant: **no command-execution or shell capability is reachable unless the operator explicitly enabled it and the channel is mutually authenticated (not a URL token alone).** Check: is exec/terminal/ping on by default? Is the token in a query string (logged, leaked)? Does the agent run as SYSTEM? Enumerate all remote-access products per host and flag duplicates or external callbacks [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md). Verify vendor instances use per-customer accounts, not shared ones [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md).

## How finders spotted it
- Correlated EDR detections: cmd.exe spawned as a service, randomized service/batch names, a PowerShell one-liner pulling an installer from raw.githubusercontent.com, then traced the process tree to NSSM and the agent [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)
- Noticed repeated ScreenConnect connect/disconnect events under one shared account across geographically separated orgs, then correlated shared instance, shared account, and identical test.xml download [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md)
- Alerted on modified canary files, then found two ScreenConnect instances, one calling out to a ddns.net domain [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md)

## Variants seen
- Monitoring agent with default exec/PTY over outbound WebSocket, run as SYSTEM [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)
- Abuse of a legitimate vendor-hosted ScreenConnect instance via shared account [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md)
- Rogue second ScreenConnect instance bypassing MFA, with dynamic-DNS callback [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md)

## Impact and severity
SYSTEM-level shell and persistent C2 [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md); initial access to multiple healthcare/pharma servers and lateral movement via created admin accounts [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md); ransomware deployment and lateral spread using embedded domain admin creds and PsExec [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md). Impact rises with agent privilege, breadth of enrolled hosts (botnet-scale scanning [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md)), and combination with credential access and lateral-movement tooling [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **ScreenConnect** 21.15.6764.8075: BlackCat Ransomware Affiliate TTPs. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps.md