🧰 ScreenConnect

The items that name it 23

• Managed for Malice: How Attackers Turn MDM into Remote Access
  writeupas classification.technologies2026-10-28
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
  writeupas tools2026-10-07

  Legitimate RMM software abused by attackers to gain and maintain remote access (rogue clients 2b302081e9e777d0 and 43773b3da4ccb17b)

• The Fine Art of Frustrating the Adversary
  articleas tools2026-10-01

  Example of an RMM tool that should be blocked or produce high-confidence alerts if not an organization's approved remote-management product.

• Phishing Abuses RMM Tools for Persistent Access
  writeupas classification.technologies2026-09-29
• Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  writeupas affected products2026-09-09

  Legitimate RMM software abused via rogue client installers to establish unauthorized persistent remote access

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas tools2026-09-03It is written here as ScreenConnect (rogue/backdoored clients).

  Legitimate RMM software abused by attackers for remote access and, when modified, to propagate the VBScript loader to newly connected Host sessions (worm-like spread).

• Daisy-Chaining Trust: Investigating Faronics Deploy Abuse | Huntress
  writeupas tools2026-08-31

  Remote access/RMM tool installed by attackers as a secondary remote access mechanism after Faronics compromise

• RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress
  articleas affected products2026-08-21

  Legitimate RMM tool abused via rogue/cracked installs by attackers; also used by defenders to access scammer infrastructure.

• Fake Refund Scam Hits Shopify Shop App Users
  writeupas tools2026-08-13

  Remote access software that scammers direct victims to install during the fake refund call to gain control of and view the victim's screen.

• Bank of America Phishing Email Delivers ScreenConnect Malware
  writeupas tools2026-08-04

  Remote monitoring and management (RMM) tool abused as malware payload for remote access/C2

• CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
  writeupas tools2026-07-09

  Legitimate remote-management software abused by the operator for persistence; rogue client installed via MSI (us.msi, SC.msi, 1111.msi) configured to call home to attacker-controlled relay infrastructure.

• LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
  articleas tools2026-07-08

  Remote access tool deployed via Action1 by attackers in the cited example for persistent remote access

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas tools2026-05-20

  Rogue RMM used by ransomware affiliates to gain initial access

• Threat Actor Defense Evasion: How Attackers Disable AV & EDR
  writeupas affected products2026-05-18

  rogue instance installed to provide threat actors with remote access in malvertising campaign

• Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
  writeupas tools2026-05-07

  Commercial RMM alternative pushed down by Tiflux in some incidents

• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeupas tools2026-04-30

  Legitimate remote access tool cited as previously abused by adversaries

• Uptick in Bomgar RMM Exploitation
  writeupas tools2026-04-17

  Remote access client used as an additional persistence mechanism by threat actors

• How a Tax Search Leads to Kernel-Mode AV/EDR Kill
  writeupas classification.technologies2026-03-19
• How Threat Actors Abuse Remote Management Tools | Huntress
  writeupas affected products2026-03-11

  RMM client repeatedly deployed via daisy-chained installers; version 25.2.4.9229 observed used by a threat actor; also observed signed via SimpleHelp, GoTo Technologies, and Datto (Centrastage) binaries.

• RMM Abuse: When IT Convenience Bites Back
  articleas affected products2026-03-05

  Cited as an example RMM tool requiring inventory/fingerprinting rather than assumed trust

• Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft
  writeupas affected products2026-01-12
• Rogue RMMs: Common Social Engineering Tactics We Saw in 2025
  writeupas tools2025-12-31

  Legitimate RMM software abused by threat actors (rogue/renamed installers) to gain unauthorized remote access to victim machines.

• A Series of Unfortunate (RMM) Events
  writeupas affected products2025-12-18