ScreenConnect Abuse by Threat Actors: A New TTP

Campaign or TTP Overview

The recent surge in misuse of the ScreenConnect Client by threat actors highlights a growing trend of abusing legitimate IT administration tools. Recently observed attacks have shown that these threat actors are leveraging ScreenConnect, now part of ConnectWise, not only to gain footholds in networks but also to maintain persistent access. In a campaign that gained momentum in the fall of 2023, adversaries targeted small to medium-sized businesses across the financial and healthcare sectors. The actors, as identified by cybersecurity firms, have remained unattributed by name, but their techniques align with organized cybercriminal groups known for financial motivations.

These threat actors exploited legitimate remote access software to execute their attacks discretely, often bypassing traditional security controls that would otherwise notify enterprises of unauthorized activity. Leveraging the trust placed in these tools, they achieved stealthier operations that increased dwell times, exacerbating potential damage.

How It Was Built

The infrastructure setup of these attacks revolved around mimicking legitimate corporate entities to distribute the ScreenConnect Client. The actors employed spear-phishing emails crafted with precision. Typical subject lines included phrases like “Urgent: VPN Access Issue” and “Immediate Security Update Required.” These emails purported to be from the target company’s IT department or partners, leveraging authentic-looking sender addresses.

Sender ID: it-support@{target-domain}.com
Subject Line: “Immediate Security Update Required”
Lure Content: The email body claimed an urgent need for a security client update and included a direct download link for said update, which was a trojaned version of the ScreenConnect Client.

Upon execution, no visible changes were immediate to the user, reinforcing the disguise as a legitimate tool update. The payload methodically established a reverse connection to the actor’s command and control servers, configured to operate on a standard port through legitimate encrypted tunnels


Payload Header:

User-Agent: ScreenConnect Client

Host: secure-connect[.]com:443

GET /client/3rdpsupport

Why It Worked

The success of this campaign largely stemmed from the misappropriated trust signals inherent to the ScreenConnect software and the sophisticated social engineering tactics. By using addresses that mirrored internal communication patterns, the attack circumvents backend filters reliant on domain reputation. The choice of subject lines evoked urgency without overt alarmism, prompting rapid compliance.

Additionally, employing an encrypted reverse tunnel over port 443 made detection incredibly difficult for less advanced monitoring systems that may overlook such common traffic patterns. This exploitation technique capitalizes on the latency of updating domain blacklists with newly registered malicious endpoints.

Operator Takeaways

Red team operators can extract several valuable strategies from this campaign. Mimicking legitimate tool updates is an effective method because the surface-level legitimacy often suffices to bypass user scrutiny. Additionally, by aligning communication with common internal patterns — such as using “vpn@{domain}.com” — the chances of initial success increase significantly.

The integration of an encrypted reverse tunnel is a noteworthy adaptation, reducing the likelihood of detection in transport security systems and endpoint response solutions. Such methods should be considered in simulations to test the efficacy of blue teams in identifying anomalous but previously rare abuse patterns of legitimate software.

Good / Better / Best

Good: Use communication patterns that mimic authentic internal or partner email addresses. Even a simple spoof has initial success potential.
Better: Craft spear-phishing content that matches the tone and urgency appropriate to the role — IT updates, HR deadlines, or finance notifications.
Best: Incorporate encrypted tunnels or disguise payload operations to emulate legitimate software opsec, ensuring prolonged undetected operation.