Threat Actors Exploit ScreenConnect to Gain Unauthorized Remote Access

Threat Actors Exploit ScreenConnect to Gain Unauthorized Remote Access reports that a surge in using remote management and monitoring tools for initial access has drawn renewed attention to ScreenConnect, with ConnectWise ScreenConnect described as a preferred option for stealthy intrusion, persistence, and lateral movement.

The piece explains attackers craft phishing lures directing victims to custom ScreenConnect installers or invite links generated through the management console, dropping an MSI that often executes in memory to avoid substantial on-disk traces. For example, a PowerShell one-liner can install the ScreenConnect agent without writing the full payload to disk, after which the agent registers itself as a Windows service to provide persistent remote access under the guise of legitimate IT maintenance.

ScreenConnect capabilities span Windows, macOS, Linux, iOS and Android, enabling cross‑platform control, and post‑deployment events such as ID 4573 signal a new remote session, followed by Application Log events 100 and 101 documenting session start and end; outbound file transfers create a folder under the victim’s Documents directory, for instance C:\Users\Kh4lifa\Documents\ConnectWiseControl\Files, with Event 201 marking transfers.

Mitigations call for treating the agent binary and its XML configuration as primary artifacts, blocking known invite link patterns, limiting RMM console access, and employing multifactor authentication, API key rotation, memory snapshot collection, DNS/IP validation in user.config, and SIEM rules for Event IDs 4573, 100 and 101.

According to GBHackers On Security, the evolving weaponisation of legitimate IT tools like ScreenConnect underscores the need for layered defence and proactive threat hunting focused on RMM platforms.