ScreenConnect Attack: SmartScreen Bypass and RMM Abuse
An attack campaign targeting organizations in the US, Canada, UK, and Northern Ireland exploits ConnectWise ScreenConnect vulnerabilities. The attack chain begins with a spoofed email containing a malicious .cmd attachment, which executes silently, escalates privileges, disables Windows SmartScreen, and removes the Mark-of-the-Web. It then installs a legitimate Remote Monitoring and Management tool, ScreenConnect, which is abused as a Remote Access Trojan for persistent command-and-control access. The campaign focuses on sectors with high-value data, including government, healthcare, and logistics. The attackers use various techniques to evade detection, including UAC bypass, registry modification, and silent MSI installation. The ScreenConnect client used has a revoked certificate, highlighting the importance of blocking vulnerable software versions and enforcing strict RMM allowlists.
Pulse ID: 698dadc62e15016f807eaccc
Pulse Link: https://otx.alienvault.com/pulse/698dadc62e15016f807eaccc
Pulse Author: AlienVault
Created: 2026-02-12 10:39:02
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Canada #ConnectWise #CyberSecurity #Email #Government #Healthcare #ICS #InfoSec #Ireland #MarkoftheWeb #OTX #OpenThreatExchange #RemoteAccessTrojan #ScreenConnect #Trojan #UK #Windows #WindowsSmartScreen #bot #AlienVault
