Anatomy of a Breach: Exposing the Backstage Shell in Shadow RMM

While artificial intelligence continues to dominate the headlines of cybersecurity publications and conference agendas, the reality on the ground tells a different story. As defenders race to build machine-learning models and autonomous defenses, threat actors are quietly orchestrating devastating attacks using conventional, highly evasive techniques like the Backstage Shell.

Recent operational data underscores a stubborn reality: traditional attack vectors are not disappearing; they are simply becoming stealthier and more sophisticated. The most catastrophic ransomware incidents today are still fueled by unmanaged assets, credential theft, registry exploitation, and the weaponization of legitimate Remote Monitoring and Management (RMM) tools.

This case study dissects a severe intrusion, offering a stark reminder that securing core infrastructure remains our absolute best defense, even in an AI-driven world.

Incident Overview & The Threat Landscape

During a recent incident response operation, our Managed Detection and Response (MDR) team successfully intercepted and neutralized a highly organized, multi-phase attack aimed at an enterprise Active Directory environment (VICTIM.local).

Unfolding over a period of days, the attack began with a signed adware downloader. It quickly escalated into a complete domain takeover, utilizing stealthy persistence via abused RMM software, and culminated in a mass ransomware deployment aimed squarely at the organization’s critical project and CAD storage shares (D:\DATA_SHARES\).

Core Incident Highlights

• Evasion via Signed Downloader: The attacker bypassed static signatures and initial browser protections by dropping an executable (ApnStub.exe) that was legitimately signed by a recognized authority (ASK.COM).
• Syskey Extraction & Hash Decryption: Using an unmanaged, agentless device on the network, the adversary queried registry secrets (HKLM\SYSTEM\...\Lsa) on a secondary Domain Controller (DC-02). This allowed them to reconstruct the 16-byte Syskey and compromise the primary domain administrator account (ADM_DOMAIN).
• Covert RMM Abuse: The attacker maintained deep persistence by exploiting ConnectWise ScreenConnect’s Backstage mode (ScreenConnect.WindowsBackstageShell.exe). Running invisibly in a secondary desktop session (hasVisibleWindow: false), it deployed system-level keyboard hooks (SetWindowsHookEx), which eventually triggered EDR alerts for stealth keylogging.
• The Unmanaged Asset Blind Spot: Crucially, the mass SMB encryption and cross-network commands were executed entirely from rogue, unmanaged IP addresses (10.10.10.177 and 10.10.10.158) that sat completely outside the organization’s EDR coverage.

Chronological Intrusion Timeline

Note: Dates and timestamps have been modified for privacy, though the sequence and exact intervals remain accurate.

Technical Deep-Dive & Forensic Analysis

Patient Zero and Initial Ingress (WKSTN-P01)

The breach originated on workstation WKSTN-P01 (10.10.10.29). Telemetry exposed the execution of an Ask Partner Network installer stub:

• Path: \Device\HarddiskVolume3\Users\user_alpha\Documents\ApnStub.exe
• Signer Status: Valid Digital Signature (ASK.COM)

Adversaries frequently employ signed adware or bundled software stubs to slip past perimeter defenses. While ApnStub.exe is not inherently malware, its presence allowed the threat actor to gain a low-privilege foothold and begin harvesting local credentials.

Syskey Query & Master Key Extraction (DC-02)

By May 15, the attacker had escalated to domain-wide control. Operating from a rogue IP (10.10.10.177) using compromised local credentials (VICTIM\adm_local), they launched remote RPC queries against Domain Controller DC-02.

The Role of Syskey: In Windows environments, password hashes inside the Security Account Manager (SAM) and NTDS.dit are encrypted using the Boot Key (Syskey), located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Without this key, offline hash extraction is impossible. The attacker deployed a custom utility to query specific LSA values (JD, Skew1, GBG, and Data), successfully assembling the 16-byte Syskey. This led directly to the offline decryption of the domain hashes and the compromise of VICTIM\adm_domain.

Evasive Persistence: The ScreenConnect Backstage Shell

To ensure resilient access, the attacker hijacked the victim’s legitimate ConnectWise ScreenConnect installation. On May 16, the service spawned ScreenConnect.WindowsBackstageShell.exe.

Why EDR Caught the Keylogger: ScreenConnect’s “Backstage” feature permits IT staff to operate a terminal behind the active user session without rendering UI elements. To capture physical keystrokes and route them to this invisible terminal (hasVisibleWindow: false), the software utilizes SetWindowsHookEx (WH_KEYBOARD_LL) running as NT AUTHORITY\SYSTEM. Because this captures raw keystrokes globally from a hidden context, modern EDR platforms correctly identify this as a low-level keylogger. This is not a false positive, but rather an accurate detection of a legitimate tool being actively weaponized.

Memory Forensics & Process Tree Analysis

Reconstructing the memory artifacts on Patient Zero illuminated the attacker’s methodology for achieving stealth:

• Session 0 Execution: The Backstage shell was spawned directly by the agent service inside the non-interactive Session 0 context.
• Hidden Desktop: Operating without a visible window allowed the attacker to run interactive command-line sessions (CMD/PowerShell) completely unnoticed by the local user.
• LSASS Probing: Memory forensics showed that during initialization, the Backstage shell requested process handles (OpenProcess) for lsass.exe and lsaiso.exe, triggering high-fidelity credential access alerts.

Indicators of Compromise (IoCs)

The cryptographic hashes, tools, and artifacts uncovered during the investigation are detailed below:

Summary Recap

This incident response analysis highlights the mechanics of a fast-moving Akira ransomware deployment. Triggered by a signed adware downloader, the attacker utilized unmanaged devices to execute LSA queries against a Domain Controller, effectively extracting the Syskey to achieve Domain Admin status. To secure deep persistence, the threat actor weaponized the Backstage Shell of an existing RMM tool, utilizing global Windows hooks to silently log activity from Session 0.

References & Further Reading

• Akira Ransomware: CISA Cybersecurity Advisory (AA24-109A) – Tactics, Techniques, and Procedures.
• SentinelOne: Technical Brief on Rollback and VSS Restoration Mechanics.
• Microsoft Technical Documentation: Active Directory Forest Recovery (krbtgt reset), LSA Secrets & Syskey Structure, and SetWindowsHookExW API dynamics.
• Guardz Platform: AI-Native Security Platform & 24/7 MDR Architecture overview.
• Guardz Research: Security Research Labs (GitHub) and the Cyber Research Blog covering threats targeting SMBs and MSPs.

Guiding MSP Clients Through Cyber Insurance Audits

This scenario highlights the core challenge of cyber insurance audits today. Having security controls is only half the battle; proving they are actively functioning across the entire environment is the other. For MSPs, helping clients navigate this process means shifting audit preparation from a frantic, last-minute scramble to a continuous, integrated security management process.

Decoding the Cyber Insurance Audit

A cyber insurance audit is a rigorous evaluation conducted by an insurer to gauge an applicant’s security hygiene before issuing or renewing a policy. Depending on the carrier, the client’s industry, desired coverage limits, and past claims, this audit can range from a simple questionnaire to demands for technical evidence, interviews, and external vulnerability scans.

The insurer’s goal is to accurately price the risk and lock in the baseline security posture the client claims to have. Expect intense scrutiny on MFA, endpoint security, email filtering, backup integrity, privileged access management, and incident response readiness.

Crucially, MSPs must understand the difference between deploying a tool and proving its efficacy. A written policy mandating MFA is useless if you cannot produce exportable logs proving it covers all admins, cloud apps, and remote access points. Audit-ready evidence links the policy to the actual configuration records, test results, and patching history.

Furthermore, it is vital to establish clear boundaries of responsibility. While the MSP may handle endpoint protection and network monitoring, the client must own legal compliance, internal employee policies, and continuity decisions. Clarifying this early prevents an application from being rejected due to a missing internal HR document.

The Evolution of Underwriting Requirements

Rewind to 2019, and getting cyber insurance often required little more than checking “yes” on a self-attestation form. However, a massive surge in devastating ransomware attacks and subsequent payout disputes forced insurers to drastically alter their approach. The market hardened, and insurers began demanding concrete proof of risk mitigation.

Since 2022, underwriting has become intensely technical. A simple “yes” is now often met with requests for configuration screenshots, backup restoration logs, and EDR deployment metrics. According to the 2025 Marsh cyber insurance market update, carriers now scrutinize 12 core cyber hygiene controls continuously.

Three key shifts impact MSPs directly:

• Stricter Terms Driven by Ransomware: To manage their exposure, insurers have introduced ransomware sublimits, coinsurance, and higher deductibles. Securing favorable terms now requires undeniable proof of robust anti-ransomware controls.
• The End of the Honor System: Annual self-attestation is being replaced by continuous external scanning and demands for updated technical evidence throughout the life of the policy.
• Expanding Security Requirements: The baseline has shifted. Alongside MFA and email security, underwriters now expect to see EDR, identity threat detection, and immutable (tamper-proof) backups.

These changes are a direct response to the modern threat landscape. The 2026 Verizon Data Breach Investigations Report highlighted that exploited vulnerabilities initiated 31% of breaches, with ransomware featuring in 48%. Static, point-in-time attestations are no longer sufficient against rapidly evolving threats.

The Cost of Failing an Audit

Failing an insurance review does more than cause administrative headaches; it fundamentally alters a client’s risk profile and business continuity plans.

• Intense Scrutiny: Insurers verify answers. If a client claims total EDR coverage but cannot prove it, the underwriter will question the validity of the entire application, slowing the process to a crawl.
• Risk of Claim Denial: If a client suffers a breach due to the failure of a control they claimed to have (e.g., MFA was disabled for an admin), the insurer will investigate. This can lead to coverage disputes, reduced payouts, or outright claim denial.
• Operational Strain on SMBs: Small businesses rarely have dedicated compliance officers. If evidence is scattered across different vendors and MSP tools, gathering it is slow and prone to errors.
• Damage to the MSP Relationship: If your MSP struggles to provide clear audit documentation, the client may look for a competitor who seamlessly integrates compliance reporting into their service offerings.

What Insurers Demand (and How to Prove It)

While specific requirements vary, underwriters consistently focus on the following core controls. MSPs must be ready to provide the corresponding evidence.

These requirements are data-driven. Coalition’s 2026 Cyber Claims Report (analyzing over 100,000 policyholders) noted that Business Email Compromise (BEC) and funds transfer fraud drove 58% of all claims. Furthermore, ransomware attacks involving both encryption and data theft accounted for 70% of ransomware claims, costing double that of encryption-only events. Consequently, insurers hyper-focus on email security, data protection, and tested recovery plans.

A Playbook for MSPs: Ensuring Audit Success

By establishing a repeatable, standardized process, MSPs can bridge the gap between technical operations and underwriting requirements, saving time across their entire client base.

1. Start the Clock at 90 Days: Three months before renewal, review the specific insurance application. Cross-reference every question against your deployed controls. Assign owners to gather specific evidence and set hard deadlines for patching vulnerabilities.
2. Construct an Evidence Vault: Standardize how you store evidence. Use consistent naming conventions for configuration exports, policies, and test logs. Date every document and clearly link it to the specific client environment it represents.
3. Eradicate the Gaps Early: Do not wait for the audit to address missing MFA, unregistered endpoints, or untested backups. Fix these issues immediately, and crucially, retest the control to generate fresh evidence of its functionality.
4. Speak the Language of Business: Underwriters and client CEOs don’t want raw syslogs. Provide reports that clearly translate technical posture into business risk, detailing control status, threat trends, and necessary actions in plain language.

Why Audits Derail: Common Pitfalls

Most audit failures aren’t due to a lack of tools, but a lack of thoroughness. Never rely on last year’s application. Ensure your current evidence aligns perfectly with your answers.

• MFA is deployed, but bypasses exist for legacy protocols, certain admin accounts, or specific cloud tools.
• The EDR console shows 100 devices protected, but the client’s active directory lists 120 devices.
• Backups run nightly, but no one has actually tested a full system restore, or the backups are vulnerable to deletion by ransomware.
• The Incident Response plan hasn’t been updated in three years and lacks instructions on when to notify the insurer.
• Security training was purchased, but there are no records proving employees actually completed it.
• Vulnerability scans show critical exposures that were never patched or formally acknowledged as accepted risks.

Managing Client Expectations vs. Underwriter Reality

Clients often misunderstand the depth of proof required. MSPs must proactively realign these expectations.

Streamlining Evidence with Guardz Client Security Reports

Gathering evidence from disparate tools is a major pain point for MSPs. The Guardz Client Security Report simplifies this by distilling complex, client-level security data into a shareable, AI-enhanced PDF. It provides a clear executive summary, a holistic security score, metrics on neutralized threats, and a breakdown of high-risk users. This gives both the client and the underwriter an immediate, digestible overview of the organization’s security posture.

While this report serves as an excellent executive cover letter for your evidence package, Guardz also allows you to export detailed CSVs outlining specific detections and compliance mapping. Note: While highly effective, these reports should supplement, not replace, specific insurer requests like signed IR plans, granular backup test logs, or specific configuration screenshots.

Achieving Audit Readiness with Guardz

Guardz empowers MSPs to transform audit preparation from a chore into a seamless byproduct of good security management.

• Holistic Control Visibility: Guardz unifies ITDR, EDR, email security, data protection, and security awareness training into a single pane of glass, making it vastly easier to track control status and remediation efforts.
• Pre-Audit Prospecting: The Prospecting Report scans external assets for vulnerabilities and leaked credentials, allowing MSPs to find and fix glaring issues before the underwriter ever sees them.
• Proof of Continuous Monitoring: Guardz pairs AI-driven triage with human-led MDR. The resulting logs of prioritized alerts, SOC investigations, and escalated responses serve as undeniable proof of 24/7 monitoring.
• Business-Aligned Reporting: By translating complex threat data into clear posture scores and executive insights, Guardz helps MSPs present a compelling, easily understood narrative to insurance reviewers.

Conclusion

Successfully navigating a cyber insurance audit requires more than just buying security tools; it requires an organized, provable demonstration of your security posture. MSPs can ensure their clients succeed by preparing early, assigning clear responsibility for evidence gathering, and treating compliance as an ongoing operational standard.

By utilizing unified reporting platforms, MSPs not only simplify the audit process but also clearly demonstrate their immense value to the client, bridging the gap between raw technical data and critical business protection.

Mastering Multi-Tenant M365 Mailbox Security for MSPs

A breached Microsoft 365 mailbox is a ticking time bomb for an entire business. Once inside, an attacker can silently monitor communications, understand corporate hierarchies, and eventually launch devastating invoice fraud from a trusted internal address. Worse, those same compromised credentials often unlock shared documents, connected SaaS applications, and access to other employees.

This level of access is highly lucrative. The Microsoft Digital Defense Report 2025 highlights a staggering 32% spike in identity-based attacks during the first half of the year. For threat actors, a mailbox is the ultimate prize—the hub of relationships and financial documents necessary to execute convincing scams.

For Managed Service Providers (MSPs), the mandate is clear: detect the breach before it paralyzes the client. While securing a single tenant is straightforward, scaling that vigilance across 50+ diverse client environments—each with unique definitions of “normal” behavior—is a massive operational hurdle.

This guide dissects the telltale signs of an M365 mailbox compromise and provides a blueprint for MSPs to detect them at scale without drowning in false positives.

The Root Cause: Why M365 Breaches are Identity Crises

Mailbox hijackings rarely involve malware or zero-day exploits. They begin when a hacker logs in using a valid password acquired via phishing, session hijacking, or the dark web. Because the login is technically legitimate, traditional endpoint security solutions are entirely blind to the attack.

Microsoft’s data reinforces this: over 97% of identity attacks utilize brute force or password spraying. The attack starts with a successful login, not a malicious file.

Therefore, your defense strategy must pivot from perimeter security to identity and behavioral analysis. You must constantly ask: Does this current session match this specific user’s historical behavior?

An isolated event—like a login from a new country or an unfamiliar app request—might be benign. But when analyzed against a user’s established baseline, these events often paint a picture of an Account Takeover (ATO). For MSPs, this means prioritizing sign-in logs, audit trails, and mailbox configurations. Crucially, because a traveling sales team behaves differently than a localized HR department, these behavioral baselines must be customized per tenant.

Red Flags: Deciphering the Signals of a Compromised Mailbox

ATO attacks usually leave a trail of distinct, recognizable actions. While one signal isn’t definitive proof, it demands investigation. Knowing what to look for in M365’s audit logs is half the battle.

These indicators frequently happen sequentially: an odd login is followed by a new forwarding rule, then an eDiscovery search, culminating in invoice fraud. Detecting the chain early minimizes the blast radius.

Cutting Through the Noise: Minimizing False Positives

Every signal listed above can be triggered by legitimate activity. A traveling CEO will trigger impossible travel alerts; a new accounting software might require broad OAuth permissions. If you don’t tune these alerts, your analysts will suffer from alert fatigue, and real attacks will be buried under routine noise.

To improve detection fidelity, implement these practices:

• Contextual Validation: Don’t blindly trust an impossible travel alert; cross-reference it against known corporate VPN exit nodes or planned executive travel.
• App Allowlists: Standardize approved OAuth apps. Only trigger alerts when consent is given to an app outside the sanctioned list.
• Prioritize Mail Rules: External auto-forwarding and “delete on receipt” rules are rarely legitimate and should be treated as high-priority alerts.
• Focus on the Grant, Not the Search: Compliance teams run eDiscovery searches constantly. The true anomaly is a new account being granted those privileges.
• Correlate and Escalate: One weak signal is noise. Two weak signals in the same session (e.g., an odd login followed immediately by a new mail rule) is an incident demanding immediate action.

Scaling Operations: Protecting 50+ Tenants Efficiently

If every client generates five identity alerts a day, an MSP with 50 clients is looking at 250 daily alerts. Throwing more human analysts at the problem destroys profitability. The solution lies in smarter aggregation and automated triage.

Building a Repeatable MSP Workflow

To scale securely, MSPs must standardize their detection processes so that any technician can handle an incident without having to memorize a specific client’s quirks.

• Baseline at Inception: Establish behavioral benchmarks the moment a new client is onboarded.
• Standardize Severity: Define exactly what constitutes a Critical vs. Low alert, and apply that standard uniformly across the portfolio.
• Isolate Exceptions: Maintain tenant-specific suppression lists (e.g., a known overseas contractor) so you don’t accidentally create blind spots in other clients’ environments.
• Unified Queues: Route all validated, high-severity alerts to one central ticketing system.
• Pre-Define Escalation: Document exactly who is responsible for action and how the client is notified, ensuring rapid response during an active crisis.

The Guardz Advantage: Unified Prevention, Detection, and Response

Managing multi-tenant M365 security requires a unified approach. Guardz consolidates these necessary workflows into a single platform, ensuring that prevention, detection, and remediation are deeply integrated.

• Prevention: Powered by Check Point Harmony, Guardz embeds robust email security upstream, blocking phishing and BEC attempts before they ever reach the inbox, while also flagging suspicious internal mailbox rules.
• Detection (ITDR): Guardz Identity Threat Detection and Response establishes custom behavioral baselines for every user across all tenants. It automatically correlates disparate signals—like impossible travel, OAuth abuse, and hidden inbox rules—into a single, coherent incident. Agentic AI handles the initial triage, ensuring that only high-fidelity alerts reach your dashboard, keeping a 50-tenant workload easily manageable.
• Comprehensive Response: When an ATO is confirmed, resetting a password isn’t enough; attackers retain access via active sessions and OAuth tokens. From the Guardz console, MSPs can instantly revoke active sessions, clear refresh tokens, delete malicious OAuth grants, strip rogue mailbox rules, and suspend the account entirely—ensuring true remediation.

For MSPs seeking extra support, Guardz MDR provides a 24/7 team of elite SOC analysts and threat hunters. They investigate validated threats, execute targeted response playbooks for ATO and BEC scenarios, and maintain constant communication—allowing MSPs to scale their security offerings without sacrificing control or profitability.

The Catalyst: Why Move Away from Huntress?

Huntress deserves immense credit for creating a product tailored for the channel. Their managed EDR, M365 ITDR, and awareness training are priced perfectly for smaller MSPs to resell with healthy margins. That is precisely why they became an industry standard.

However, when MSPs seek alternatives, it is rarely due to a drop in Huntress’s quality; rather, it’s a structural misalignment. Huntress remains heavily focused on the endpoint and M365 identity. If you need robust email security, deep Google Workspace integration, or broader cloud posture visibility, you are forced to procure additional tools.

Furthermore, per-agent pricing quickly inflates as client fleets expand. Some MSPs crave immediate, autonomous containment over guided remediation alerts. Others face client pressure for firm, contractual response SLAs (often driven by cyber insurance requirements). Most simply want to escape console fatigue. Your specific pain point will dictate which of the seven alternatives below is your ideal match.

Decision Point: Augment vs. Replace

Not everyone needs a hard break from Huntress. A significant percentage of MSPs are just looking to plug a specific hole—like email filtering or a sudden client demand for an SLA. Before committing to grueling vendor demos, diagnose your exact situation.

• Augment Huntress if: The vast majority of your incidents still happen on the endpoint, your clients exclusively use M365, and you only lack one or two specific features. Bolting on a point solution is cheaper and easier than a full migration—provided you can stomach the extra invoice and alert dashboard.
• Replace Huntress if: The feature gaps are multiplying, the bulk of your threats now originate in email or identity platforms, or you are already juggling four or more security consoles per client. At this juncture, the operational cost of tool sprawl heavily outweighs the friction of migration.

Our Evaluation Methodology

We assessed each platform against five critical pillars that determine if a vendor is a true business partner to an MSP, rather than just a software provider:

1. Margin Potential: Does the pricing model map to how you actually bill your clients, and does it allow for healthy markup?
2. Multi-Tenancy: Can you efficiently manage dozens of distinct client environments from a single, truly segregated console?
3. Cloud Suite Coverage: How deep does the protection go for M365 and Google Workspace, where SMB attacks actually commence?
4. Response SLA: What is the vendor’s ironclad, contractual commitment when a crisis hits at 3:00 AM? (Marketing claims don’t count).
5. Partner Ecosystem: Do they offer true channel enablement, or will they eventually bypass you to sell directly to your clients?

Deep Dive: The 7 Alternatives

1. Guardz

Guardz is an agentic, unified detection and response platform engineered specifically for MSPs. It merges endpoint, email, identity, and cloud security with built-in 24/7 MDR—all accessible via a singular, multi-tenant dashboard.

2. Blackpoint Cyber

Blackpoint Cyber offers a channel-exclusive MDR solution, combining its SNAP-Defense engine with a fiercely proactive SOC that isolates threats autonomously.

3. Field Effect

Field Effect provides MDR tailored for MSPs and lean IT departments, uniquely bundling endpoint, cloud, and network telemetry into a single per-user fee.

4. Sophos MDR

A giant in the MDR space, Sophos delivers a highly adopted channel service managed seamlessly through the Sophos Central Partner console.

5. Arctic Wolf

Arctic Wolf delivers its open XDR Aurora Platform and Concierge Security Team to the channel, recently redesigning its 2025 program to lower deal minimums and improve scalable pricing.

6. SentinelOne

SentinelOne equips MSPs with a highly autonomous EDR wrapped in true multi-tenant management (Singularity), with the option to layer on Wayfinder MDR for 24/7 oversight.

7. CrowdStrike

CrowdStrike combines its elite Falcon Complete Next-Gen MDR with Flight Control, a robust multi-tenant management layer designed explicitly for service providers.

The Final Verdict for 2026

Selecting the right Huntress alternative hinges entirely on your specific pain points. If you crave instant, autonomous endpoint isolation, Blackpoint Cyber and SentinelOne are your top targets. If you need a hard SLA to satisfy insurance audits, Sophos MDR delivers. If your roadmap points toward enterprise clients, Arctic Wolf and CrowdStrike provide the necessary firepower. If you want maximum telemetry per dollar, Field Effect is hard to beat.

Guardz represents a fundamental shift in strategy. Rather than swapping out one fragmented tool for another, Guardz consolidates M365/Google Workspace email, identity, endpoint, and cloud protection into a single, unified agentic platform with built-in MDR. Priced per-user to match your billing model, it is designed exclusively for the SMB-focused MSP. If that aligns with your client book, the most prudent next step is to spin up the free Community tier on your own tenant and put it to the test.