A Silent Threat: How a Stealthy Campaign Is Stealing ScreenConnect Credentials for Ransomware

The Mimecast Threat Research team, led by Samantha Clarke, has exposed an ongoing credential harvesting campaign designated MCTO3030 that has quietly targeted ScreenConnect cloud administrators since 2022, with strong indications that compromised credentials are being funnelled to ransomware affiliates for large-scale attacks. According to Mimecast researchers, the operation has demonstrated remarkable operational security through low-volume distribution that has allowed it to operate largely undetected.

The attackers target high-value users such as senior IT professionals, system administrators, directors and security staff with ScreenConnect super administrator privileges, since these credentials provide comprehensive control over remote access infrastructure across entire organisations. The campaign relies on spear phishing emails distributed via Amazon Simple Email Service accounts, offering trusted infrastructure, high deliverability and low cost.

The phishing flow includes initial contact with claims of suspicious login activity, urging recipients to click a Review Security button, and a Real-time Adversary-in-the-Middle approach using the EvilGinx framework to capture credentials and MFA tokens.