Rogue Agent on Your Network? Find It Before It Wins

Someone Else Is Running Software on Your Network Right Now

A post circulating in MSP communities recently described something that should make every IT admin's stomach drop: a competing MSP quietly deployed remote management agents on a client's network, created a new domain admin account, installed deployment tooling, and added a global admin account to the Microsoft 365 tenant — all without authorization. The client had no idea until it was almost too late.

This isn't a theoretical attack. It's a real pattern, and it's not limited to shady MSP competitors.

According to The Hacker News, China-made ZBT routers are shipping with two factory-installed implants — SPEAKINGSTONE and DARKLANTERN — that give unauthenticated attackers persistent root-level access to the device. The owner never installed them. They were there from the start. That's the same threat model as the rogue MSP story, just at the hardware layer: software you didn't authorize, running silently, giving someone else control.

And according to The Hacker News, the APT28-linked HOOKEDGE backdoor — targeting European government and diplomatic organizations — persisted undetected from late September 2025 through April 2026. It was built partly from a Windows batch script. Not sophisticated malware. A batch script. Seven months, undetected.

The message is clear: unauthorized agents don't have to be clever to be devastating. They just have to go unnoticed.

Why This Happens to Small Businesses and MSP Clients

Small organizations are especially vulnerable because they often lack the monitoring tools to know what "normal" looks like on their network. If you don't have a baseline, you can't detect drift. A new service running on a workstation, a new admin account in your tenant, a new scheduled task firing at 2 AM — these are invisible without something watching for them.

This is also a shadow IT problem. Whether it's a competing MSP, a vendor who "just needed to install something real quick," or a well-meaning employee who downloaded a remote access tool, unauthorized software enters networks through trusted people making unreviewed decisions. We've covered the broader shadow IT risk in our post on shadow IT and department-level security bypass — but the MSP version is particularly dangerous because the actor often has legitimate credentials to start with.

Step 1: Audit What's Running on Your Endpoints

Start with your Windows endpoints. Open Task Manager or use PowerShell to enumerate running services and processes. Better yet, use Autoruns from Sysinternals — it shows everything that launches at startup, including scheduled tasks, services, browser extensions, and more. Look for:

• Remote management agents you didn't install (Action1, AnyDesk, ScreenConnect, Atera, etc.)
• Scheduled tasks created recently with unfamiliar names or paths
• Services running from temp directories or user profile folders — a major red flag
• Recently installed software via Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* in PowerShell

If you manage multiple endpoints, a vulnerability scanner can surface installed software across all machines at once rather than checking one by one.

Step 2: Audit Admin Accounts in Entra ID (Azure AD)

This is the step most small businesses skip — and it's exactly what the rogue MSP exploited.

SANS ISC published guidance on auditing Entra ID admin rights that every IT admin should read. The core question: do you actually know every account that holds Global Administrator, Privileged Role Administrator, or Exchange Administrator rights in your tenant?

To check: 1. Log into the Microsoft Entra admin center 2. Navigate to Identity > Roles & admins > All roles 3. Click Global Administrator and review every member 4. Look for accounts you don't recognize, service accounts with admin rights, or guest accounts with elevated permissions

Any account you can't explain should be treated as compromised until proven otherwise. Disable it, don't delete it — you may need the audit trail.

We've covered identity-layer threats in depth in our post on identity threat detection for small businesses — if you haven't read it, the Entra ID section alone is worth your time.

Step 3: Check for Unauthorized Remote Access Tools

Rogue RMM agents are particularly dangerous because they're designed to be persistent and hard to remove. Check for:

• Listening ports: Use netstat -ano on Windows to see what's communicating outbound. Cross-reference PIDs against running processes.
• Firewall rules: Look for recently added inbound or outbound rules in Windows Firewall that you didn't create.
• Installed services: Run sc query type= all state= all and look for services with generic or obfuscated names.
• Browser extensions: These can act as lightweight remote access tools. Audit extensions across all browsers on managed machines.

For a deeper look at how RMM tools can be weaponized against you, see our guide on unauthorized RMM agents and rogue remote access detection.

Step 4: Review Recent Domain Admin Changes

In on-premises Active Directory environments:

Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name, SamAccountName, ObjectClass

Then check your event logs for Event ID 4728 (member added to security-enabled global group) and Event ID 4720 (user account created). Filter for the past 30–90 days. If you see accounts you didn't create, you have a problem.

Step 5: Evict and Contain

If you find something unauthorized:

1. Isolate the affected machine from the network before removing anything — you want to preserve forensic state.
2. Disable, don't delete unauthorized accounts in both AD and Entra ID.
3. Revoke active sessions in Entra ID under the user's profile (Sign-in logs > Revoke sessions).
4. Uninstall the agent through Programs & Features or via command line, then verify the service is gone and no scheduled tasks remain.
5. Reset credentials for any account the unauthorized tool could have accessed — assume it logged keystrokes or harvested tokens.
6. Document everything with timestamps. If this becomes a legal or insurance matter, your notes are evidence.

The Uncomfortable Truth About Detection

Most small businesses won't find rogue agents through manual audits. They'll find them after something breaks, or after a user complains, or after a breach. Manual audits are better than nothing, but they're a snapshot — they tell you what's running right now, not what ran last Tuesday at 3 AM and quietly uninstalled itself after exfiltrating data.

The ZBT router implants and the APT28 batch script both survived for months precisely because no one was watching continuously. Continuous visibility — knowing what's on your network, what's changed, and what's talking to the internet — is what separates detection from discovery-after-the-fact.

Take Action: Don't Wait for a Breach to Find Out

If you're not actively auditing what's running on your endpoints and who has admin rights in your tenant, you're flying blind. Rogue agents, unauthorized admin accounts, and factory-installed implants are not edge cases — they're documented, recurring threats that hit organizations exactly like yours.

Oscar Six Security's Radar gives you an outside-in view of your network's exposure for $99 per scan — no agent to install, no contract, no enterprise pricing. It's designed specifically for small businesses and IT admins who need real answers without a six-figure security budget.

See what Radar finds on your network →

Focus Forward. We've Got Your Six.