We sell managed services. We run remote management tooling on client estates. So writing this up is awkward, and that is precisely why it should come from us rather than only from people with nothing at stake.
What happened
On 6 February 2026, BeyondTrust disclosed CVE-2026-1731, a critical flaw in its Bomgar remote support product allowing unauthenticated remote code execution. Exploitation began within a week. Huntress observed a first wave from 12 February and a sharp uptick from 3 April.
Two incidents from that second wave are worth stating plainly.
On 14 April, a compromised Bomgar instance at a dental software company was used to deploy ransomware. Three downstream companies were affected — customers of that vendor, attacked through it.
On 15 April, attackers took a high-privilege Bomgar account belonging to an MSP. From there they reached a domain controller, created administrator credentials for persistence and escalated to Domain Admin. The response required the mass isolation of 78 businesses, with exploitation confirmed across four downstream customers.
The pattern was not confined to one product. Sophos documented DragonForce ransomware operators exploiting a chain of SimpleHelp vulnerabilities — CVE-2024-57727, CVE-2024-57728 and CVE-2024-57726 — to reach an MSP's remote management platform and push malicious installers to client endpoints, exfiltrating data on the way for double extortion.
And attackers do not always need a vulnerability. In July, Microsoft tracked phishing campaigns that persuaded targets to install a genuine MSP360 agent, then used that foothold to install a ConnectWise ScreenConnect client as a second, redundant channel. No exploit — just legitimate remote management software, installed by the victim, serving the attacker.
Why this tooling is such a good target
A remote monitoring and management platform exists to do three things across many machines at once: see them, change them, and run things on them. That is the value. It is also, stated without the marketing, a remote code execution capability with an administrative console in front of it.
Three properties make it unusually attractive:
Reach. One console can touch every endpoint under management, often across multiple unrelated businesses. Compromising one MSP account is worth compromising dozens of companies individually.
Trust. The agent is signed, expected and allowlisted. Endpoint protection is configured not to interfere with it. Actions it takes look like administration because they are administration.
Standing access. Unlike a stolen user credential, which gets you one person's permissions, RMM access is designed to be privileged and persistent.
This is the same structural problem as the Stryker wipe through Intune and as ChainDrop's spread through npm: the thing built to apply a change everywhere is the thing an attacker most wants, and it is working correctly when they use it.
What this means if you buy managed services
If someone manages your IT, their security is part of yours, whether or not that appears in the contract. That is not an argument against outsourcing — an in-house team with the same tooling has the same exposure and usually less practice. It is an argument for asking specific questions.
Ask your provider, in writing:
- Is MFA enforced on the RMM console for every technician, and is it phishing-resistant? Push notifications and SMS codes are the weakest acceptable answer; hardware keys or passkeys are the right one.
- What is your patch SLA for the management tooling itself? The Bomgar flaw was disclosed on 6 February and exploited within days. Ask how quickly they patch the platform that controls your machines — not how quickly they patch yours.
- Is console access restricted by source IP or network? An administrative interface reachable from the whole internet is reachable by everyone on it.
- Is there a separate tenant or credential boundary per customer? When an MSP account is compromised, the question that determines your blast radius is whether their other clients' estates were reachable from it.
- What requires a second person to approve? Mass script execution, bulk software deployment and fleet-wide commands should not be one tired technician away from happening.
- What does your logging show, and would I get told? Ask who reviews RMM audit logs, how an anomalous mass action is detected, and what their notification commitment to you is when something involves your environment.
- Have you been compromised, and what happened? The answer "no, never" from anyone who has operated at scale for years deserves more scepticism than a straight account of an incident and what changed afterwards.
If a provider is uncomfortable answering these, that discomfort is itself information. We would rather you asked us these questions than didn't — and if you are a client and want our answers in writing, ask and we will put them in writing.
What this means if you run the tooling yourself
The same list applies, with one addition: the RMM is in scope for your own vulnerability management, and it is near the top. Organisations routinely patch endpoints diligently through a platform they have not themselves updated in months. Check what version your console is on before you read any further.
The summary
Through the spring of 2026, attackers repeatedly took the shortest path available: compromise the tool that already has permission to change everything, and let it do the work. Sometimes that took a critical CVE; sometimes it took a convincing phishing email and a genuine installer.
There is no version of managed IT that removes this risk, because the capability being abused is the capability being sold. What can change is how hard that console is to reach, how fast it is patched, how much of the world one compromised account can touch, and whether anyone is watching it. Those are answerable questions, and a provider worth having will answer them without being pushed.
Sources
- Threat advisory: uptick in Bomgar RMM exploitation — Huntress
- DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers — Sophos
- DragonForce ransomware leveraged in MSP attack using RMM tool — Infosecurity Magazine
- Phishing abuses RMM tools for persistent access — Microsoft Security
- Attackers abuse MSP360 to deploy ScreenConnect in dual-RMM phishing attacks — The Hacker News
