Full Report
Bad actors are abusing Faronics Deploy in phishing campaigns to run PowerShell, deploy ScreenConnect, and evade detection by using trusted tools.
Analysis Summary
# Tool/Technique: Legitimate RMM Abuse (Faronics Deploy)
## Overview
Threat actors are abusing **Faronics Deploy**, a legitimate remote monitoring and management (RMM) platform, to gain persistence and execute code on victim workstations. By using a legitimately signed installer, attackers bypass traditional security controls that trust known software vendors. Once the victim is tricked into installing the agent via phishing lures, the attacker uses the platform's native management features to deploy secondary payloads like ScreenConnect and execute PowerShell scripts.
## Technical Details
- **Type:** Technique (Living-off-the-Land / RMM Abuse)
- **Platform:** Windows
- **Capabilities:** Remote code execution, software deployment, persistence, environment discovery.
- **First Seen:** July 2026 (Reported surge observed July 21 – August 20, 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services] (Abuse of RMM)
- **[TA0005 - Defense Evasion]**
- [T1553.002 - Subvert Trust Controls: Code Signing]
- [T1036 - Masquerading] (Disguised as Adobe/Zoom installers)
## Functionality
### Core Capabilities
- **Legitimate Enrollment:** The attacker delivers a signed Faronics installer. When run, the device connects to the attacker’s Faronics Deploy console.
- **Remote Script Execution:** Utilizing the platform’s "ScriptRunner" capability to execute PowerShell commands without direct user interaction.
- **Software Deployment:** Pushing additional remote access tools (RATs) like ScreenConnect to ensure redundant access.
### Advanced Features
- **Visitor-Based Cloaking:** The delivery infrastructure uses JavaScript fingerprinting (User-Agent, resolution, etc.) to serve the malicious installer only to valid targets while showing benign decoy sites (e.g., Eastern Bank) to analysis environments.
- **Mobile Filtering:** Automatically redirects mobile devices to a `denied.html` page to avoid detection and wasted effort.
## Indicators of Compromise
- **File Names:** Legitimate Faronics installers renamed to mimic documents (e.g., `Invoice.exe`, `Adobe_Plugin_Update.exe`).
- **Network Indicators:**
- `fileportals.gytgtecg[.]xyz` (Phishing/Fingerprinting)
- `denied.html` (Redirection page)
- **Behavioral Indicators:**
- Execution of `ScriptRunner.exe` initiating unauthorized PowerShell sessions.
- Unexpected installation of Faronics Deploy or ScreenConnect in environments where these tools are not standard.
- **Artifacts:**
- `ScriptRunner.log` (Contains logs of executed PowerShell tasks).
- The `ck` deployment identifier (Found in Faronics-related files, used to cluster specific attacker campaigns).
## Associated Threat Actors
- Unknown (Campaign characterized by high-volume phishing and "daisy-chaining" trust between multiple RMM tools).
## Detection Methods
- **Behavioral Detection:** Monitor for legitimate RMM binaries (like Faronics or ScreenConnect) spawning PowerShell or cmd.exe with suspicious arguments.
- **Log Analysis:** Scrutinize `ScriptRunner.log` for commands that perform reconnaissance (e.g., `whoami`, `net view`) or download external files.
- **Infrastructure Tracking:** Monitor for connections to Faronics or ScreenConnect cloud endpoints that do not originate from authorized administrative IP spaces.
## Mitigation Strategies
- **Application Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to block unauthorized RMM tools.
- **Software Restriction:** Prevent the execution of downloaded installers from temporary directories or user profile folders (Downloads/AppData).
- **User Education:** Train users to recognize that legitimate documents (PDFs, Docx) should not prompt for the installation of software or "plugins" to be viewed.
## Related Tools/Techniques
- **ScreenConnect Abuse:** Frequently used in tandem with Faronics for persistent remote access.
- **SimpleHelp / AnyDesk Abuse:** Similar RMM-based persistence techniques.
- **Living-off-the-Land (LotL):** The broader strategy of using trusted tools for malicious ends.