Inside the Backstage Shell: An RMM Abuse Case Study

Anatomy of a Breach: Exposing the Backstage Shell in Shadow RMM

While artificial intelligence continues to dominate the headlines of cybersecurity publications and conference agendas, the reality on the ground tells a different story. As defenders race to build machine-learning models and autonomous defenses, threat actors are quietly orchestrating devastating attacks using conventional, highly evasive techniques like the Backstage Shell.

Recent operational data underscores a stubborn reality: traditional attack vectors are not disappearing; they are simply becoming stealthier and more sophisticated. The most catastrophic ransomware incidents today are still fueled by unmanaged assets, credential theft, registry exploitation, and the weaponization of legitimate Remote Monitoring and Management (RMM) tools.

This case study dissects a severe intrusion, offering a stark reminder that securing core infrastructure remains our absolute best defense, even in an AI-driven world.

Incident Overview & The Threat Landscape

During a recent incident response operation, our Managed Detection and Response (MDR) team successfully intercepted and neutralized a highly organized, multi-phase attack aimed at an enterprise Active Directory environment (VICTIM.local).

Unfolding over a period of days, the attack began with a signed adware downloader. It quickly escalated into a complete domain takeover, utilizing stealthy persistence via abused RMM software, and culminated in a mass ransomware deployment aimed squarely at the organization’s critical project and CAD storage shares (D:\DATA_SHARES\).

Core Incident Highlights

• Evasion via Signed Downloader: The attacker bypassed static signatures and initial browser protections by dropping an executable (ApnStub.exe) that was legitimately signed by a recognized authority (ASK.COM).
• Syskey Extraction & Hash Decryption: Using an unmanaged, agentless device on the network, the adversary queried registry secrets (HKLM\SYSTEM\...\Lsa) on a secondary Domain Controller (DC-02). This allowed them to reconstruct the 16-byte Syskey and compromise the primary domain administrator account (ADM_DOMAIN).
• Covert RMM Abuse: The attacker maintained deep persistence by exploiting ConnectWise ScreenConnect’s Backstage mode (ScreenConnect.WindowsBackstageShell.exe). Running invisibly in a secondary desktop session (hasVisibleWindow: false), it deployed system-level keyboard hooks (SetWindowsHookEx), which eventually triggered EDR alerts for stealth keylogging.
• The Unmanaged Asset Blind Spot: Crucially, the mass SMB encryption and cross-network commands were executed entirely from rogue, unmanaged IP addresses (10.10.10.177 and 10.10.10.158) that sat completely outside the organization’s EDR coverage.

Chronological Intrusion Timeline

Note: Dates and timestamps have been modified for privacy, though the sequence and exact intervals remain accurate.

Technical Deep-Dive & Forensic Analysis

Patient Zero and Initial Ingress (WKSTN-P01)

The breach originated on workstation WKSTN-P01 (10.10.10.29). Telemetry exposed the execution of an Ask Partner Network installer stub:

• Path: \Device\HarddiskVolume3\Users\user_alpha\Documents\ApnStub.exe
• Signer Status: Valid Digital Signature (ASK.COM)

Adversaries frequently employ signed adware or bundled software stubs to slip past perimeter defenses. While ApnStub.exe is not inherently malware, its presence allowed the threat actor to gain a low-privilege foothold and begin harvesting local credentials.

Syskey Query & Master Key Extraction (DC-02)

By May 15, the attacker had escalated to domain-wide control. Operating from a rogue IP (10.10.10.177) using compromised local credentials (VICTIM\adm_local), they launched remote RPC queries against Domain Controller DC-02.

The Role of Syskey: In Windows environments, password hashes inside the Security Account Manager (SAM) and NTDS.dit are encrypted using the Boot Key (Syskey), located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Without this key, offline hash extraction is impossible. The attacker deployed a custom utility to query specific LSA values (JD, Skew1, GBG, and Data), successfully assembling the 16-byte Syskey. This led directly to the offline decryption of the domain hashes and the compromise of VICTIM\adm_domain.

Evasive Persistence: The ScreenConnect Backstage Shell

To ensure resilient access, the attacker hijacked the victim’s legitimate ConnectWise ScreenConnect installation. On May 16, the service spawned ScreenConnect.WindowsBackstageShell.exe.

Why EDR Caught the Keylogger: ScreenConnect’s “Backstage” feature permits IT staff to operate a terminal behind the active user session without rendering UI elements. To capture physical keystrokes and route them to this invisible terminal (hasVisibleWindow: false), the software utilizes SetWindowsHookEx (WH_KEYBOARD_LL) running as NT AUTHORITY\SYSTEM. Because this captures raw keystrokes globally from a hidden context, modern EDR platforms correctly identify this as a low-level keylogger. This is not a false positive, but rather an accurate detection of a legitimate tool being actively weaponized.

Memory Forensics & Process Tree Analysis

Reconstructing the memory artifacts on Patient Zero illuminated the attacker’s methodology for achieving stealth:

• Session 0 Execution: The Backstage shell was spawned directly by the agent service inside the non-interactive Session 0 context.
• Hidden Desktop: Operating without a visible window allowed the attacker to run interactive command-line sessions (CMD/PowerShell) completely unnoticed by the local user.
• LSASS Probing: Memory forensics showed that during initialization, the Backstage shell requested process handles (OpenProcess) for lsass.exe and lsaiso.exe, triggering high-fidelity credential access alerts.

Indicators of Compromise (IoCs)

The cryptographic hashes, tools, and artifacts uncovered during the investigation are detailed below:

Summary Recap

This incident response analysis highlights the mechanics of a fast-moving Akira ransomware deployment. Triggered by a signed adware downloader, the attacker utilized unmanaged devices to execute LSA queries against a Domain Controller, effectively extracting the Syskey to achieve Domain Admin status. To secure deep persistence, the threat actor weaponized the Backstage Shell of an existing RMM tool, utilizing global Windows hooks to silently log activity from Session 0.

References & Further Reading

• Akira Ransomware: CISA Cybersecurity Advisory (AA24-109A) – Tactics, Techniques, and Procedures.
• SentinelOne: Technical Brief on Rollback and VSS Restoration Mechanics.
• Microsoft Technical Documentation: Active Directory Forest Recovery (krbtgt reset), LSA Secrets & Syskey Structure, and SetWindowsHookExW API dynamics.
• Guardz Platform: AI-Native Security Platform & 24/7 MDR Architecture overview.
• Guardz Research: Security Research Labs (GitHub) and the Cyber Research Blog covering threats targeting SMBs and MSPs.