The campaign begins with a phishing email that tricks the recipient into running a malicious script or executable. Once executed, the malware connects to the Faronics Deploy service using stolen or misappropriated credentials, effectively turning the victim's machine into a managed endpoint under the attacker's control. From there, the attackers silently deploy ScreenConnect, a legitimate remote access tool, to establish persistent interactive access to the compromised system.

Key technical details of the attack include:

• The abuse of Faronics Deploy's legitimate administrative functions to bypass application allowlisting and endpoint detection and response (EDR) products.
• ScreenConnect is installed without user interaction, using the platform's deployment mechanisms rather than typical droppers or loaders.
• The attackers use the remote access session to perform follow-up actions such as credential harvesting, data exfiltration, or deploying additional payloads.
• Faronics Deploy is not compromised; rather, the attackers are abusing valid accounts, likely obtained through phishing or infostealer malware.

Indicators that an environment may have been targeted include:

• Unexpected Faronics Deploy agent enrollment for machines that are not part of an organization's legitimate deployment setup.
• Unusual ScreenConnect client installations appearing on endpoints without corresponding IT helpdesk activity.
• Outbound network connections to Faronics and ScreenConnect infrastructure originating from non-admin workstations.

To mitigate this threat, administrators should:

• Audit all Faronics Deploy accounts for unrecognized users or roles and enforce multi-factor authentication.
• Restrict ScreenConnect installation and execution to authorized administrative accounts only, using application controls where possible.
• Monitor for new endpoint management enrollments and remote support sessions in logs, correlating them with helpdesk tickets.
• Review email gateway rules for phishing lures that reference IT support or remote access tools.

This campaign highlights a growing trend: attackers increasingly abuse legitimate remote management and support tools to blend in with normal administrative activity, making detection reliant on behavioral analysis rather than signature-based defenses.

Source: BleepingComputer

Is your organization auditing for unauthorized enrollments in remote management platforms like Faronics Deploy, or are you relying on EDR rules to catch this behavior post-installation?