SOC Prime Bias: Medium

05 Jan 2026 17:56
newspaper icon Huntress

Rogue ScreenConnect: Common Social Engineering Tactics We Saw in 2025

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Rogue ScreenConnect: Common Social Engineering Tactics We Saw in 2025
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Threat actors are delivering malicious ScreenConnect (remote monitoring and management) clients through social‑engineering lures such as fake Social Security statements, invitation letters and invoice documents. The lures are distributed via phishing emails and malicious web pages, leading victims to download renamed ScreenConnect executables. Once installed, the rogue RMM provides the attacker with persistent remote access to the compromised host.

Investigation

Huntress observed dozens of incidents between January and September 2025 where renamed ScreenConnect binaries were executed on endpoints in multiple industries. The SOC collected associated domain names, IP addresses and file hashes, noting repeated use of dynamic DNS services and specific lure naming patterns. Detailed log analysis showed the malicious client contacting attacker‑controlled domains for command‑and‑control.

Mitigation

Organizations should strengthen security awareness training to spot fake statements, invoices and invitation files. Continuous monitoring of remote access tools, restricting execution of unsigned RMM binaries and auditing network connections to known malicious domains are recommended. Keep RMM software patched and whitelist only authorized instances.

Response

Upon detection of a renamed ScreenConnect executable, isolate the endpoint, collect the binary and associated network traffic, and block the C2 domain at the firewall. Perform a forensic analysis to identify persistence mechanisms and lateral movement, then remediate compromised accounts and reset credentials.

graph TB %% Class definitions classDef technique fill:#ffcc99 classDef tool fill:#cccccc classDef operator fill:#ff9900 %% Node definitions tech_initial_access_phishing[“<b>Technique</b> – <b>T1566 Phishing</b><br/><b>Description</b>: Threat actors send crafted emails impersonating Social Security statements, invoices, or invitations with malicious links.”] class tech_initial_access_phishing technique tech_malicious_link[“<b>Technique</b> – <b>T1204.001 Malicious Link</b><br/><b>Description</b>: Victim clicks a malicious link that redirects to a download page.”] class tech_malicious_link technique tech_malicious_file[“<b>Technique</b> – <b>T1204.002 Malicious File</b><br/><b>Description</b>: Victim downloads and runs an executable disguised as a document or invitation.”] class tech_malicious_file technique op_user_execution((“User Execution”)) class op_user_execution operator tech_masquerading[“<b>Technique</b> – <b>T1036 Masquerading</b><br/><b>Sub-techniques</b>: T1036.008 Masquerade File Type, T1036.003 Rename Legitimate Utilities, T1036.007 Double File Extension<br/><b>Description</b>: Payload is renamed to appear legitimate and avoid detection.”] class tech_masquerading technique tech_rat_installation[“<b>Technique</b> – <b>T1219 Remote Access Tool Installation</b><br/><b>Description</b>: Installation of a ScreenConnect client providing remote monitoring and management capabilities.”] class tech_rat_installation technique tool_screenconnect[“<b>Tool</b> – <b>Name</b>: ScreenConnect (ConnectWise Control)<br/><b>Description</b>: Remote access software used as a RAT.”] class tool_screenconnect tool tech_dynamic_dns[“<b>Technique</b> – <b>T1568.002 Domain Generation Algorithms</b><br/><b>Description</b>: Uses dynamic DNS services and generated domains for C2 communication.”] class tech_dynamic_dns technique tech_app_layer_dns[“<b>Technique</b> – <b>T1071.004 Application Layer Protocol: DNS</b><br/><b>Description</b>: C2 traffic transmitted over DNS queries.”] class tech_app_layer_dns technique tech_app_layer_web[“<b>Technique</b> – <b>T1071.001 Application Layer Protocol: Web</b><br/><b>Description</b>: C2 traffic transmitted over HTTPS web protocols.”] class tech_app_layer_web technique tech_web_service_bidirectional[“<b>Technique</b> – <b>T1102.002 Web Service: Bidirectional Communication</b><br/><b>Description</b>: Uses web service for bidirectional C2 communication.”] class tech_web_service_bidirectional technique tech_external_remote_services[“<b>Technique</b> – <b>T1133 External Remote Services</b><br/><b>Description</b>: Maintains persistence via external remote services allowing ongoing access.”] class tech_external_remote_services technique tech_hide_artifacts[“<b>Technique</b> – <b>T1564.012 Hide Artifacts: File/Path Exclusions</b><br/><b>Description</b>: Configures exclusions to hide malicious files from security tools.”] class tech_hide_artifacts technique tech_passive_dns[“<b>Technique</b> – <b>T1596.001 Search Open Technical Databases: Passive DNS</b><br/><b>Description</b>: Uses passive DNS data to discover or register malicious domains.”] class tech_passive_dns technique %% Connections tech_initial_access_phishing –>|delivers| op_user_execution op_user_execution –>|uses| tech_malicious_link op_user_execution –>|uses| tech_malicious_file op_user_execution –>|leads to| tech_masquerading tech_masquerading –>|enables| tech_rat_installation tech_rat_installation –>|installs| tool_screenconnect tool_screenconnect –>|contacts| tech_dynamic_dns tool_screenconnect –>|uses| tech_app_layer_dns tool_screenconnect –>|uses| tech_app_layer_web tool_screenconnect –>|uses| tech_web_service_bidirectional tech_dynamic_dns –>|supports| tech_external_remote_services tech_external_remote_services –>|enables| tech_passive_dns tech_dynamic_dns –>|supports| tech_hide_artifacts

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An attacker crafts a phishing email with an attachment named Social_Security_Statement_redacted.exe that actually contains a legitimate ScreenConnect installer (or any payload). The victim, believing it to be a personal finance document, double‑clicks the file. The OS launches the executable, producing a process‑creation event where the Image field ends with the malicious filename. This exact pattern matches the Sigma rule and should raise an alert.

  • Regression Test Script:

    # --------------------------------------------------------------
# Simulation script – triggers the "Rogue ScreenConnect" rule
# --------------------------------------------------------------

# 1. Prepare a benign payload (e.g., calc.exe) and rename it
$src = "$env:SystemRootSystem32calc.exe"
$dst = "$env:TempSocial_Security_Statement_redacted.exe"

Copy-Item -Path $src -Destination $dst -Force

# 2. Optionally set hidden attribute to mimic evasion (T1564.004)
attrib +h $dst

# 3. Execute the renamed payload (simulating user click)
Start-Process -FilePath $dst

# 4. Wait briefly to ensure logging
Start-Sleep -Seconds 5

# 5. Output confirmation
Write-Host "Executed $dst – should generate detection telemetry."

  • Cleanup Commands:

    # Remove the malicious‑looking executable and clear attribute
$file = "$env:TempSocial_Security_Statement_redacted.exe"
if (Test-Path $file) {
    attrib -h $file
    Remove-Item -Path $file -Force
    Write-Host "Cleanup complete: $file removed."
} else {
    Write-Host "File not found; nothing to clean."
}

End of Report

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free