Remote Monitoring and Management Tools: A Gateway for Bulk Attacks on MSP Customers, Pt. 2

Huntress investigated multiple incidents in June–July where threat actors compromised an MSP's Atera RMM to install Cloudflare tunnels, create accounts, disable Defender, and deploy Akira ransomware across MSP and customer endpoints; analysts used endpoint and RMM logs to correlate identical TTPs and IOCs across attacks and the SOC rapidly isolated affected systems to limit impact.