ConnectWise ScreenConnect Critical Vulnerability Exploited by Attackers

Key Takeaways

• Attackers are exploiting ConnectWise ScreenConnect by distributing legitimate client software via phishing emails.
• The phishing campaign masquerades as a payment notification, luring recipients into downloading a remote access tool instead of an invoice.
• The downloaded ScreenConnect client is genuine but configured to connect to an attacker-controlled server.
• This tactic bypasses traditional malware detection by leveraging trusted software for illicit remote access.
• No specific vulnerability (CVE) in ScreenConnect itself is being exploited; rather, the legitimate functionality of the tool is being abused.

Attackers Leverage Legitimate ScreenConnect Client in Phishing Scheme

Cyber adversaries are employing a sophisticated phishing strategy that uses a legitimate ConnectWise ScreenConnect client to establish unauthorized remote access. Instead of deploying custom malware, the campaign deceives recipients into installing software specifically designed for remote connectivity, masking its true purpose behind a fabricated payment notification.

The deceptive emails claim that a payment totaling $5745.65 has been successfully received, prompting recipients to view purported order details in a PDF. This approach mirrors previous remote access phishing attempts where administrative tools are disguised as common documents or routine workplace downloads.

Researchers at the Internet Storm Center uncovered this abuse after a detailed examination of the downloaded program. In a report shared with Cyber Security News (CSN), the Internet Storm Center said the file was an authentic ScreenConnect client, pre-configured to communicate with an attacker-operated test account.

The analysis, published on October 1, 2026, by Xavier Mertens, focuses on an observed phishing attempt and does not indicate a widespread breach or provide a victim count or evidence of stolen data. However, it underscores a critical security concern: how legitimate remote support applications can become conduits for unauthorized access when their configurations are manipulated by attackers.

Abusing Trusted Remote Access Tools

The phishing emails are crafted to appear routine, featuring a wire transfer subject line and a paid invoice receipt format. To further entice recipients, the message includes an offer for cancellation and an immediate refund if the charge is unrecognized, providing an additional incentive for recipients to investigate the unexpected transaction.

The core deception is straightforward: the promised PDF document is, in reality, a Windows executable. Clicking the link initiates the download of a ScreenConnect installer, not the advertised order document. The success of this attack hinges on persuading the recipient to execute software delivered through an unsolicited financial message.

Mertens noted that the phishing email successfully bypassed basic security filters. He also pointed out that modern web browsers typically flag and block the download of executables, a suspicious activity. The report does not confirm whether any recipient bypassed these browser protections or successfully installed the client on a target system.

This technique mirrors other legitimate Remote Monitoring and Management (RMM) phishing campaigns that leverage trusted remote management applications as payloads instead of readily identifiable malicious software. However, the ISC report does not link this specific email campaign to other operations or attribute it to a particular threat group. At the time of Mertens’ analysis, the downloaded file was unknown to VirusTotal.

Mertens’ investigation revealed that the client was preconfigured to connect to a specific cloud-hosted ScreenConnect instance on port 443. This configuration directs the client to an attacker’s account, bypassing an organization’s authorized support environment.

Detection Challenges

A significant challenge for detection arises from the fact that the executable bore a valid digital signature from ConnectWise, LLC, issued by DigiCert G4 Code Signing CA1. The Authenticode digest matched the signed digest precisely, confirming the integrity of the file content as published by the vendor.

Mertens found no extraneous data appended to the executable nor any alterations or injections in its certificate table, explicitly ruling out any signed-but-tampered configuration tricks. This finding is crucial because the suspicious activity stems from the software’s intended remote access functionality, not a modified binary. This scenario highlights the difficulty in distinguishing between a legitimate program and its malicious use.

In this case, the software itself was authentic, but the email misrepresented what the recipient would receive. The critical questions for defenders become: Who initiated the installation, and to which remote account is the client configured to connect upon execution?

For cybersecurity defenders, this distinction fundamentally alters the investigative approach. Prior research on detecting the abuse of trusted tools emphasizes the collective importance of download context, user expectations, execution activity, and subsequent network connections. A legitimate installer alone does not validate the authorization of the resulting remote session. The ISC report directs readers to the LOLRMM project for a comprehensive inventory of remote management tools susceptible to misuse by attackers.

The broader takeaway is that even familiar support applications warrant rigorous scrutiny when their installation follows an unexpected email rather than a verified support request. The indicators of compromise (IoCs) provided below are specific to the ISC report and should not be conflated with other campaigns. The published key hash is abbreviated and not a complete SHA-256 value. The relay hostname listed refers to legitimate cloud infrastructure associated with the observed configuration and does not imply that all ScreenConnect connections are malicious.

Indicators of Compromise (IoCs):

• Sender email: contact@mejuri[.]com (Address displayed in the phishing email’s From field; the report does not establish ownership or sender authenticity.)
• Sender domain: mejuri[.]com (Domain appearing in the displayed sender address.)
• Download URL: hxxps://thelittlecupandsaucer[.]com[.]au/ScreenConnect.ClientSetup.exe (Defanged destination of the email’s document-viewing link, delivering the executable.)
• Download domain: thelittlecupandsaucer[.]com[.]au (Domain hosting the linked ScreenConnect installer.)
• File name: ScreenConnect.ClientSetup.exe (Executable delivered instead of the promised PDF.)
• Relay hostname: instance-v2e3e2-relay.screenconnect.com (Legitimate ScreenConnect relay specified in the attacker-configured client.)
• Network port: 443 (Connection port extracted from the client configuration; not independently malicious.)
• Instance ID: v2e3e2 (ConnectWise-hosted cloud instance identified in the configuration.)
• Abbreviated SHA-256: 16b1cec1…9b00ead7 (Published fragment of the RSA-2048 public-key blob hash. This is not a complete hash or an executable hash.)
• Telephone number: +1(332)638474823 (Customer-support number displayed in the phishing message, reproduced exactly as published.)
• Contextual file name: rutserv.exe (Listed only as an example of another remote utility; not reported as a payload in this attempt.)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Educate Users: Conduct regular training on identifying phishing attempts, especially those involving financial notifications or unexpected software downloads. Emphasize vigilance against unsolicited emails prompting software installation.
• Implement Email Security: Deploy robust email filtering solutions that can detect and block malicious links, suspicious attachments, and spoofed sender addresses.
• Enforce Browser Security: Ensure browser security settings are configured to warn users about or block the download of executable files from untrusted sources.
• Monitor Endpoint Activity: Utilize Endpoint Detection and Response (EDR) solutions to monitor for unusual process execution, unauthorized remote access tool installations, and suspicious network connections originating from legitimate software.
• Review Remote Access Policies: Strictly control and monitor the installation and use of remote access software within your organization. Ensure all remote access sessions are authorized, logged, and audited.
• Scrutinize Legitimate Tools: Treat installations of legitimate remote management tools originating from unexpected channels with the same suspicion as unknown malware. Focus on the context of the download and the configuration of the installed software.
• Cross-Reference IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems and threat intelligence platforms for proactive detection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.