An MSP sysadmin logged into a client's server one afternoon and found something that shouldn't have been there: a competitor's Action1 remote management agent, two new domain admin accounts, and a global admin silently added to their Microsoft 365 tenant. Nobody on the team installed any of it. The client had no idea. That story — shared in an MSP community forum — isn't just an industry horror story about client poaching. It's a precise technical blueprint for how malicious actors operate every single day against small businesses.
The attack vector is identical whether the actor is a shady competitor, a ransomware crew, or a nation-state group: get software running on your network that you don't know about, then use it to take what you want. The only question is whether you'll notice before they do.
This week's threat headlines make that question urgent.
The Threat Landscape Right Now
According to The Hacker News, a campaign distributing ValleyRAT is hiding a full remote-access backdoor inside a digitally signed adware application. Users install what looks like a legitimate, signed app — and then, because it's signed, they add it to their antivirus exclusions themselves. The attacker ends up with persistent access to the endpoint, and the user's own security tools are configured to ignore it.
That's the rogue agent problem in its purest form: software running on your machine that you didn't authorize, dressed up to look like something you did.
According to The Hacker News, the TerminalFix campaign takes a different route — a fake Cloudflare CAPTCHA tricks users into running a PowerShell command that deploys a reverse-tunnel backdoor. Functionally, this is identical to a rogue remote management agent: the attacker gets persistent, hidden network access through a channel you never opened. As we've covered in our guide to ClickFix fake CAPTCHA attacks, this social engineering technique is now a standard delivery mechanism for exactly this kind of unauthorized access.
At the infrastructure level, The Hacker News reports that the China-linked Fire Ant group is compromising Cisco routers to steal credentials and deliberately blind security logs. They install themselves into trusted network management layers and erase their tracks — the advanced version of the same problem. When your logging is compromised, passive detection fails entirely.
And according to Krebs on Security, the TeamPCP group embedded malicious code inside open-source software packages — a supply-chain variant where attacker-controlled code runs inside software you deliberately installed and trust. Detecting this requires knowing not just what is installed, but what that software is actually doing.
Five different attack stories. One common defensive gap: you don't have a reliable, current picture of what's running on your network.
5 Detection Methods Compared
Here's a practical comparison of how you can close that gap, ranked from lowest to highest effort and coverage.
1. Manual Installed Programs Audit (Low Effort, Low Coverage)
How it works: Run Get-WmiObject -Class Win32_Product in PowerShell, or check Programs and Features on each endpoint. Cross-reference against your approved software list.
Catches: Obvious installs that show up in standard registry locations.
Misses: Software that doesn't register as an installed product (portable executables, scripts, agents installed as services), anything that's been deliberately hidden, and anything that runs only in memory.
Verdict: Useful as a spot-check. Completely inadequate as a detection strategy. ValleyRAT and Action1-style agents will survive this audit.
2. Windows Event Log + Service Auditing (Medium Effort, Medium Coverage)
How it works: Review Event ID 7045 (new service installed), 4688 (new process created), and 4720/4728 (new accounts/group membership changes). This is exactly how you'd have caught the MSP client-poaching scenario — new domain admin accounts generate 4720 events.
Catches: New services, new privileged accounts, process creation (if audit policy is enabled).
Misses: Attackers who clear logs (Fire Ant's exact playbook), events that occurred before your review window, and anything that doesn't create a service.
Verdict: Essential baseline. Enable process creation auditing now if you haven't. But if your logs are being cleared or forwarded nowhere, this is a dead end.
3. Network Traffic Baseline + Anomaly Detection (Medium-High Effort, High Coverage)
How it works: Establish a baseline of normal outbound connections from each endpoint. Flag new persistent connections, unexpected DNS lookups, or traffic to unusual destinations.
Catches: Reverse tunnels (TerminalFix's backdoor has to phone home), C2 beacons, data exfiltration, and rogue agents communicating with external management infrastructure.
Misses: Attackers who blend into existing traffic patterns or use legitimate cloud services (many RMM agents communicate over standard HTTPS to vendor infrastructure that looks clean).
Verdict: One of the most reliable detection layers for persistent unauthorized access. Requires a capable firewall with logging, or a dedicated network monitoring tool. As we covered in our UniFi vs SonicWall comparison, your firewall choice significantly impacts your visibility here.
4. Endpoint Inventory + Software Allowlisting (High Effort, High Coverage)
How it works: Maintain a continuously updated inventory of every executable, service, and agent on every endpoint. Flag anything not on the approved list. Full allowlisting blocks unapproved execution entirely.
Catches: Everything that executes — including signed adware carrying ValleyRAT, portable tools, and RMM agents.
Misses: Supply-chain attacks where malicious code runs inside approved software (TeamPCP's approach). Allowlisting trusts the package, not the package's contents.
Verdict: The gold standard for unauthorized software detection, but operationally demanding. Requires disciplined change management and ongoing maintenance. Most small businesses can't sustain full allowlisting but should maintain an endpoint inventory.
5. Vulnerability and Exposure Scanning (Medium Effort, Broad Coverage)
How it works: Regular external and internal scans identify open ports, exposed services, unexpected listening processes, and misconfigurations that indicate unauthorized software or access. A scan that finds an RMM agent's management port open on a server where no RMM should exist is a direct detection signal.
Catches: Exposed services from rogue agents, open management ports, new attack surface that appeared since your last scan, and misconfigurations attackers exploit to maintain access.
Misses: Software that doesn't open a network port or expose a service (pure in-memory implants).
Verdict: The most accessible high-value detection method for small businesses and IT admins without a full security stack. A scan gives you an external view of what your network is actually advertising — including things you didn't put there. This also maps directly to CMMC Level 1 compliance requirements around asset inventory and access control.
The Detection Stack You Actually Need
No single method catches everything. The MSP client-poaching scenario would have been caught by event log auditing (new admin accounts) and network monitoring (new agent traffic) and a vulnerability scan (unexpected management port). The ValleyRAT campaign would survive an event log review but gets flagged by network anomaly detection when it beacons home.
For most small businesses and IT admins, a practical minimum is:
- Event log auditing with alerts on new services and privileged account creation
- Regular vulnerability scans to catch new exposed services and attack surface
- Firewall logging with periodic review of outbound connection patterns
If you're managing clients as an MSP, add endpoint inventory to that list — the client-poaching scenario is also your liability scenario if a rogue agent on a client network goes undetected.
The common thread in every attack this week — signed backdoors, fake CAPTCHAs, router implants, supply-chain code — is that attackers count on you not having a current, accurate picture of what's running. Regular scanning is how you take that assumption away from them.