{
  "family": "screenconnect",
  "sample_count": 14,
  "category": "ransomware",
  "description": "HackTool:Win32/Screenconnect represents the critical, malicious abuse of **ConnectWise ScreenConnect**, a completely legitimate and highly popular Remote Monitoring and Management (RMM) and remote support software. While built for IT administrators, ScreenConnect has become a favorite 'Living off the Land' (LotL) tool for ransomware operators (like ALPHV/BlackCat and LockBit) and Initial Access Brokers to maintain persistent, highly stealthy backdoor access to compromised networks.<br><br><b>Understanding ScreenConnect Abuse</b><br>To an end-user, the execution of the ScreenConnect client is entirely invisible, running as a background service. For a security analyst, detecting the unauthorized installation of ScreenConnect is an extreme red flag. Attackers abuse legitimate RMM tools because the software is digitally signed and the outbound network traffic to the ScreenConnect cloud servers is almost universally trusted by corporate firewalls and EDR platforms. It provides the attacker with a fully encrypted, highly reliable GUI backdoor that bypasses most static defenses.<br><br><b>Execution and Persistence Mechanics</b><br>Attackers typically deploy a custom ScreenConnect client (`.msi` or `.exe`) after gaining initial access via phishing or exploiting edge devices (`T1105`). They execute the installer silently via command-line switches (`T1059.003`). Once installed, ScreenConnect runs as a high-privilege Windows Service (`T1543.003`), guaranteeing persistence across reboots. The attacker can now connect to the endpoint via their own ConnectWise cloud console, entirely bypassing the victim's VPN or firewall. From this console, they have full SYSTEM-level access to transfer files (drop ransomware), execute commands via a remote terminal, and move laterally across the network.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a complete, unmonitored backdoor into the enterprise. Because the software is legitimate, traditional antivirus will NOT flag it. Threat hunters must rely on process execution logs and software inventory auditing. Any instance of `ScreenConnect.ClientService.exe` launching unexpectedly, especially if it was downloaded to a temporary directory (`%Temp%`) or executed by `cmd.exe` rather than an IT deployment tool, must be investigated immediately. Network logs showing connections to unknown ConnectWise relay servers (often `*.screenconnect.com`) are strong IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1219",
    "T1543.003",
    "T1059.003",
    "T1036"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Deploying the RMM)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1036",
      "name": "Masquerading (Hiding in legitimate traffic)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; an unauthorized RMM installation means an attacker currently has interactive, remote control of the machine.",
    "Use the `sc stop` and `sc delete` commands to halt and remove the unauthorized ScreenConnect Windows service.",
    "Review firewall and proxy logs to identify the specific ScreenConnect instance/URL the client was communicating with, and block it enterprise-wide.",
    "Initiate a hunt across the network for lateral movement, as attackers frequently use RMM tools on a 'beachhead' machine to pivot to Domain Controllers."
  ],
  "what_to_avoid": [
    "Do not assume ScreenConnect traffic is safe simply because your IT department uses it; verify the specific instance ID and ensure the installation was authorized.",
    "Avoid trying to uninstall the tool via the Control Panel while the attacker is active; use EDR to kill the service forcefully to sever their connection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}