From our archive: Originally published February 18, 2025. Product features, pricing and availability mentioned in this article may have changed.

When Third-Party Vendor Access Becomes Your Risk

Many businesses trust third-party vendors with critical systems, assuming they have security under control. But what happens when those vendors become the weak link?

Recently, we encountered an unauthorized access attempt involving a vendor’s remote support tool - a risk that could have resulted in widespread compromise. Thanks to our proactive monitoring and fast response, we contained the threat before it could escalate, ensuring our customer’s systems remained secure.

🔍 Quick Summary:

✔ A third-party vendor’s remote access tool was compromised, putting a customer’s systems at risk.
✔ Our monitoring system detected unauthorized access before it could escalate.
✔ We coordinated with the vendor, forced a full review, and secured the customer’s environment.
✔ We implemented long-term protections to prevent similar threats in the future.
✔ Businesses must proactively monitor vendor access to prevent security risks.

The Threat: A Compromised Remote Access Tool Used by a Third-Party ERP Support Vendor

Many organizations rely on external vendors for ERP system maintenance, software support, and troubleshooting. In this case, a third-party vendor was using remote access software (SimplyHelp) to manage a customer’s ERP system.

🚨 The Problem: During routine security monitoring, we detected suspicious domain enumeration commands running on multiple machines. This is a key warning sign that someone was probing the network for sensitive data and user accounts - a tactic often used before launching lateral movement attacks.

Further investigation revealed that this activity originated from SimplyHelp, the vendor’s remote support tool. If left unchecked, this could have escalated into a major security breach.

Our Incident Response Process

When a security threat originates from a third-party vendor, immediate coordination is essential. Here’s how we contained and resolved the issue.

1. Immediate Communication & Coordination

✔ Contacted the customer’s Point of Contact (POC) – Transparency is key. We alerted the customer immediately so they understood the potential risk.

✔ Engaged the third-party vendor – Since SimplyHelp was their tool, we needed their cooperation.

🚩 Initial Vendor Response:
At first, the vendor denied that their system was the source of the unauthorized activity. However, we provided clear logs and evidence showing that a compromised account within their remote access tool had been used to run unauthorized commands.

🚨 Confirmation of the Compromise:
After further review, the vendor acknowledged that their logs did show unauthorized access through a compromised account. This confirmed our findings and allowed us to move forward with remediation.

2. Containment & Remediation

✔ Guided the vendor on next steps – Since this was an external security failure, we worked with the vendor to limit exposure across their customer base.

✔ Isolated and secured affected machines – The impacted customer systems were immediately removed from the network to prevent further risk.

✔ Eradicated the threat – Our team:

Terminated all unauthorized remote sessions
Worked with the vendor to Remove affected credentials to block further access
Reviewed security logs and threat intelligence feeds for persistence mechanisms

✔ Restored systems securely – Once we validated that all malicious activity was removed, we brought the machines back online under strict monitoring.

3. Strengthening Security & Long-Term Prevention

Even after resolving the immediate issue, long-term security required additional proactive measures to ensure this never happened again.

✅ Continuous Monitoring for Remote Access Tools – We created custom alerts for any SimplyHelp-related activity moving forward.

✅ Automated Remediation Deployment – To eliminate future risks, we implemented an automation policy that shuts down and removes SimplyHelp from customer systems if detected.

✅ Restricting Vendor Access – We worked with the customer to ensure that vendor access was restricted to pre-approved times, users, and IP addresses using a tool we provide that requires two factor authentication on login.

Key Takeaways for Businesses Using Third-Party Vendors

This incident underscores the importance of third-party security oversight. Even when vendors provide critical services, their security shortcomings can put your business at risk.

💡 Best Practices for Organizations Relying on Third-Party Vendors:

✔ Limit vendor access – Vendors should only have access to specific systems, during specific times, from specific locations.
✔ Require Multi-Factor Authentication (MFA) – Every vendor account should be protected with MFA to reduce the risk of unauthorized access.
✔ Implement Security Monitoring – Log and review all vendor activity to detect suspicious behavior early.
✔ Work with a proactive cybersecurity provider – Having a dedicated security team ensures that threats are caught before they cause damage.

Find Out What Your Vendors Can Reach

Many organizations assume their IT vendors have strong security measures in place - but as this case shows, that isn’t always true.

📢 If your business relies on outside vendors, Cyber Shift Technologies can help you review the access they have to ERP systems, remote access tools, and IT infrastructure.

✅ Book a free 30-minute call to talk it through.
📞 Call (330) 353-8420 or email info@cybershift.com now.

Case Study: Responding to a Remote Access Exploit