Bomgar Remote Support Tool Data Archiving Activity

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•3

Detects the use of common archive utilities (tar, zip, 7z) by the Bomgar remote support service process (bomgar-rep.exe or bomgar-scc.exe). This pattern is often associated with post-exploitation data staging where an attacker compresses internal files prior to exfiltration.