Hackers abuse Faronics Deploy admin tool to install ScreenConnect
-
Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install ScreenConnect remote support software. The attack chain leverages the trusted nature of Faronics Deploy, which is designed for IT administrators to manage endpoints, making the malicious activity harder to detect by security tools and users alike.
The campaign begins with a phishing email that tricks the recipient into running a malicious script or executable. Once executed, the malware connects to the Faronics Deploy service using stolen or misappropriated credentials, effectively turning the victim's machine into a managed endpoint under the attacker's control. From there, the attackers silently deploy ScreenConnect, a legitimate remote access tool, to establish persistent interactive access to the compromised system.
Key technical details of the attack include:
- The abuse of Faronics Deploy's legitimate administrative functions to bypass application allowlisting and endpoint detection and response (EDR) products.
- ScreenConnect is installed without user interaction, using the platform's deployment mechanisms rather than typical droppers or loaders.
- The attackers use the remote access session to perform follow-up actions such as credential harvesting, data exfiltration, or deploying additional payloads.
- Faronics Deploy is not compromised; rather, the attackers are abusing valid accounts, likely obtained through phishing or infostealer malware.
Indicators that an environment may have been targeted include:
- Unexpected Faronics Deploy agent enrollment for machines that are not part of an organization's legitimate deployment setup.
- Unusual ScreenConnect client installations appearing on endpoints without corresponding IT helpdesk activity.
- Outbound network connections to Faronics and ScreenConnect infrastructure originating from non-admin workstations.
To mitigate this threat, administrators should:
- Audit all Faronics Deploy accounts for unrecognized users or roles and enforce multi-factor authentication.
- Restrict ScreenConnect installation and execution to authorized administrative accounts only, using application controls where possible.
- Monitor for new endpoint management enrollments and remote support sessions in logs, correlating them with helpdesk tickets.
- Review email gateway rules for phishing lures that reference IT support or remote access tools.
This campaign highlights a growing trend: attackers increasingly abuse legitimate remote management and support tools to blend in with normal administrative activity, making detection reliant on behavioral analysis rather than signature-based defenses.
Source: BleepingComputer
Is your organization auditing for unauthorized enrollments in remote management platforms like Faronics Deploy, or are you relying on EDR rules to catch this behavior post-installation?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login