Full Report
From lures involving Social Security statements to top domains and hashes used in attacks, here's an in-depth look at incidents involving ScreenConnect in 2025.
Analysis Summary
# Tool/Technique: Rogue ScreenConnect (ConnectWise Control) Abuse
## Overview
This technique involves the unauthorized deployment or hijacking of ScreenConnect (now ConnectWise Control), a legitimate Remote Monitoring and Management (RMM) software. Threat actors use it to establish persistent remote access, bypass security controls by using trusted binaries ("Living off the Land"), and move laterally within a target network. In 2025, this is primarily achieved through sophisticated social engineering lures.
## Technical Details
- **Type:** Tool (RMM Abuse / Living off the Land)
- **Platform:** Windows (primarily), macOS, Linux
- **Capabilities:** Remote desktop control, file transfer, command execution, system inventory, and persistence.
- **First Seen:** Continuous abuse documented; specific uptick in updated lures noted in early 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]
- **[TA0005 - Defense Evasion]**
- [T1218 - System Binary Proxy Execution]
- [T1564 - Hide Artifacts]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0008 - Lateral Movement]**
- [T1210 - Exploitation of Remote Services]
## Functionality
### Core Capabilities
- **Unattended Access:** Installation of a service-based client that allows the attacker to connect at any time without user interaction.
- **Remote Command Line:** Execution of PowerShell or CMD commands directly through the ScreenConnect web interface.
- **File Transfer:** Bi-directional moving of scripts, malware, or exfiltrated data.
### Advanced Features
- **Blending In:** Because ScreenConnect is a legitimate tool often used by MSPs, its network traffic and process execution often bypass standard EDR/AV alerts.
- **UAC Bypass:** The tool often runs with SYSTEM privileges, allowing attackers to perform administrative tasks without further escalation.
## Indicators of Compromise
- **File Names (Lures):**
- `Social_Security_Statement_April2025_Updates.Client.exe`
- `Social-S-Statement-May.exe`
- `partyinvitecard(6).exe`
- `RSVPINVITE(1).exe`
- `Overdue-invoice.pdf---DocuSignViewer.Client(1).exe`
- `SSA_Earnings_Statement_2025.pdf.Client.exe`
- `RevisedStatementJAN2025.exe`
- **Network Indicators:**
- Connections to `*.screenconnect.com` (if not used by the organization).
- Connections to `*.relaysp.com` (ConnectWise relay infrastructure).
- **Behavioral Indicators:**
- `ScreenConnect.Client.Service.exe` running from `C:\Windows\Temp\` or `AppData\Local\Temp\`.
- Sudden appearance of `ScreenConnect.Client.exe` on workstations not managed by internal IT.
- Execution of `cmd.exe` or `powershell.exe` as a child process of ScreenConnect.
## Associated Threat Actors
- Broadly used by **Ransomware Affiliates** (e.g., BlackCat/ALPHV, LockBit).
- Financial motivated groups.
- General "Initial Access Brokers" (IABs).
## Detection Methods
- **Signature-based:** While the binary itself is signed and legitimate, detections focus on the *filename* (e.g., detecting ".Client.exe" extensions on files masquerading as PDFs).
- **Behavioral:**
- Monitor for ScreenConnect processes originating from browser downloads (e.g., `Chrome.exe` -> `Social_Security_Statement...exe`).
- Alert on any ScreenConnect installation that does not match the organization’s specific instance ID.
- **YARA/SIEM:** Scan for the presence of the ScreenConnect "Client Setup" strings in non-standard directories.
## Mitigation Strategies
- **Application Whitelisting:** Block execution of RMM tools (ScreenConnect, AnyDesk, TeamViewer) that are not explicitly approved for corporate use.
- **Network Filtering:** Block outbound traffic to known RMM relay domains unless they are tied to a known-good corporate account.
- **User Education:** Train employees to recognize that government agencies (like the SSA) will never send an `.exe` file for a statement.
- **Attack Surface Management:** Regularly audit installed programs for unauthorized RMM clients.
## Related Tools/Techniques
- **AnyDesk / TeamViewer:** Frequently used in similar social engineering campaigns.
- **PDQ / GoTo Resolve:** Mentioned as tools used to deploy ScreenConnect.
- **Faronics Deploy:** Abused to "daisy-chain" trust and install ScreenConnect.