Leveraging legitimate software is one of cybercriminals\u2019 tactics of choice, with remote management tools ranking among their top tools. A recent example involves the remote administration utility ScreenConnect. It\u2019s designed for IT support teams to troubleshoot systems and configure software seamlessly in the background. However, when weaponized by threat actors, ScreenConnect becomes a versatile attack vehicle used to harvest data, deploy malware, and move laterally across corporate networks.<\/p>\n
During a recent incident detected by Kaspersky Managed Detection and Response<\/a>, our experts identified an attempt to use ScreenConnect in an attack. This allowed a detailed study<\/a> of how attackers used this application in a large-scale malware distribution campaign. The following breakdown illustrates the mechanics of ScreenConnect-assisted attacks, and outlines key strategies to defend your organization against them.<\/p>\n In the campaign analyzed by our experts, the attackers bundled ScreenConnect with legitimate free business software. They established a network of phishing websites to spoof popular tools, including OBS Studio, DS4Windows, DNS Jumper, Glary Utilities, Bandizip, Process Hacker, and others.<\/p>\n These rogue websites featured high-quality designs that could be taken for the official pages, making them highly convincing to unsuspecting users. Once the victim clicks the download button for the software, an archive is downloaded to their computer that contains additional files alongside the requested application:<\/p>\n Launching the renamed file disguised as the app installer triggers DLL sideloading of a malicious library. This library silently runs the ScreenConnect installation without restarting the system, while using the standard Windows installer to set up the software the user originally tried to install.<\/p>\n The attackers used search engine optimization techniques to drive traffic to their fake websites. As a result, these malicious pages appeared at the top of search results for certain free software utilities on major search engines.<\/p>\n Our experts discovered over 90 domain names translated into more than 10 different languages. While most of these websites targeted English, Russian, and Chinese speakers, several domains catered to German, French, Spanish, Arabic, and other regional audiences.<\/p>\n A detailed analysis of the IP addresses and associated spoofed domains is available in our technical research article<\/a> on Securelist, along with full indicators of compromise.<\/p>\n In this campaign, attackers leveraged ScreenConnect to generate and execute malicious scripts on victim machines. These scripts served several key functions: they created exclusions for specific drives, directories, and processes within Windows Defender, disabled the User Account Control (UAC) security mechanism, and delivered and deployed AsyncRAT \u2013 a remote access Trojan.<\/p>\n To maintain persistence, the scripts configured a Windows scheduled task to run the malicious code at preset intervals. AsyncRAT then established a connection with the attackers\u2019 command-and-control server to receive further instructions.<\/p>\n The primary objective of this campaign appears to be gaining unauthorized access to enterprise systems, likely to then resell it on cybercrime marketplaces.<\/p>\n Although ScreenConnect in and of itself is a legitimate tool, its presence poses a security risk to corporate environments. Consequently, Kaspersky security solutions<\/a> detect this application as not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen.<\/em><\/p>\n Security teams should implement the following controls:<\/p>\nHow ScreenConnect reaches target computers<\/h2>\n
\n
Why the attackers exploited ScreenConnect<\/h2>\n
How to secure corporate infrastructure<\/h2>\n
\n