ScreenConnect Abused by Threat Actors to Gain Unauthorized Remote Access to Your Computer
## Cybersecurity: ScreenConnect Exploitation by Threat Actors
Cybersecurity: ScreenConnect Exploitation by Threat Actors
Remote monitoring and management (RMM) tools, such as ScreenConnect by ConnectWise, are crucial for IT administrators, enabling remote control, unattended access, and automation across enterprise endpoints. Recently, security researchers have noted an increase in threat actors repurposing ScreenConnect as a backdoor for unauthorized access and control.
These attacks typically originate from phishing campaigns targeting compromised credentials. Attackers exploit ScreenConnect's installer and invite-link mechanisms to circumvent traditional security measures, maintaining a minimal on-disk presence.
The process begins with spear-phishing emails that mimic legitimate IT alerts, prompting recipients to download a custom ScreenConnect installer or click an invite link.
Upon execution, the installer operates entirely in memory, avoiding signature-based antivirus detection, and installs a temporary service binary. The implanted agent then registers as a Windows service, granting attackers full access to file systems, process execution, and the host’s network stack.
Within hours, attackers are able to move laterally, escalate privileges, and exfiltrate sensitive data under the guise of routine maintenance. Analysts from Dark Atlas have discovered that adversaries dynamically customize builder configurations, embedding unique hostnames and encrypted launch keys into the client's system.config file to evade network detection.
Recently, security researchers have noted an increase in threat actors repurposing ScreenConnect as a backdoor for unauthorized access and control.
This strategy obfuscates command-and-control channels and ensures each deployment appears as a distinct operational instance, complicating detection and response efforts for security teams.
Infection Mechanism and Installer Artifacts
ScreenConnect's installer uses built-in RMM features to avoid detection and maintain persistence. Attackers create a custom builder from the management console, selecting an MSI or EXE packager based on the target environment.
Upon launch, the installer writes a WindowsClient executable and associated DLLs into a directory such as C:\ProgramData\ScreenConnectClient\ and invokes the service with an obfuscated command line. An example command is:
Start-Process -FilePath "msiexec.exe" -ArgumentList "/i ScreenConnect.ClientSetup.msi /qn /norestart" -WindowStyle Hidden
The agent creates a system.config XML file to bind the client to its command server. Persistence is achieved through the registered Windows service named ScreenConnect ClientService , which restarts the binary on reboot.
Memory-only artifacts, such as live chat transcripts and session logs, exist solely in process heaps, requiring volatile memory capture for forensic analysis.
By combining in-memory execution, custom-config builders, and encrypted launch keys, threat actors transform a legitimate RMM solution into a stealthy remote access Trojan, complicating security operations.
Based on reporting by Cyber Security News.