{
  "family": "screenconnect",
  "sample_count": 14,
  "category": "hacktool",
  "description": "ScreenConnect (ConnectWise ScreenConnect, classified across security telemetry as Tool:Win32/ScreenConnect and RemoteAccess:Win32/ScreenConnect) is a legitimate remote desktop and IT management software suite that is extensively weaponized and abused by cybercrime syndicates and ransomware cartels (e.g., BlackCat/ALPHV, LockBit, Play, and BianLian). Threat actors abuse exposed ConnectWise ScreenConnect instances or weaponize critical remote code execution vulnerabilities (such as CVE-2024-1709 and CVE-2024-1708) to deploy unauthorized ScreenConnect client agents. The tool provides operators with high-privilege interactive desktop access, file transfer, and remote command execution, effectively serving as an unblockable, legitimate-appearing backdoor to facilitate enterprise-wide ransomware deployment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Tool:Win32/ScreenConnect",
    "RemoteAccess:Win32/ScreenConnect",
    "ScreenConnect Remote Access",
    "ConnectWise ScreenConnect Abuse",
    "HackTool:Win32/ScreenConnect"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Tool:Win32/ScreenConnect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ScreenConnect is a legitimate remote management tool frequently weaponized by ransomware cartels as a covert backdoor for lateral movement."
      }
    },
    {
      "@type": "Question",
      "name": "Why do ransomware operators favor ScreenConnect over custom RATs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it is a digitally signed, legitimate administrative utility that bypasses standard antivirus and firewall egress blocks."
      }
    },
    {
      "@type": "Question",
      "name": "Which vulnerabilities in ScreenConnect have threat actors exploited?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors extensively exploited authentication bypass and remote code execution flaws (CVE-2024-1709 and CVE-2024-1708)."
      }
    },
    {
      "@type": "Question",
      "name": "What actions can attackers perform via compromised ScreenConnect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Execute arbitrary shell commands with SYSTEM privileges, transfer secondary tools, and deploy enterprise ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect unauthorized ScreenConnect instances?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Audit running ScreenConnect Client services, monitor connections to unauthorized relay servers, and patch ScreenConnect servers immediately."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1219",
    "T1190",
    "T1059.003",
    "T1059.001",
    "T1543.003",
    "T1071.001"
  ],
  "cisa_advisory": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-054a",
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Deploying the RMM)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1036",
      "name": "Masquerading (Hiding in legitimate traffic)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; an unauthorized RMM installation means an attacker currently has interactive, remote control of the machine.",
    "Use the `sc stop` and `sc delete` commands to halt and remove the unauthorized ScreenConnect Windows service.",
    "Review firewall and proxy logs to identify the specific ScreenConnect instance/URL the client was communicating with, and block it enterprise-wide.",
    "Initiate a hunt across the network for lateral movement, as attackers frequently use RMM tools on a 'beachhead' machine to pivot to Domain Controllers."
  ],
  "what_to_avoid": [
    "Do not assume ScreenConnect traffic is safe simply because your IT department uses it; verify the specific instance ID and ensure the installation was authorized.",
    "Avoid trying to uninstall the tool via the Control Panel while the attacker is active; use EDR to kill the service forcefully to sever their connection."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "cisa_title": "CISA KEV CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
  "cisa_date": "2026-09-11",
  "last_reviewed": "2026-10-13",
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "CISA Alert (AA24-054A) - Threat Actors Exploiting ConnectWise ScreenConnect Vulnerabilities",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-054a"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Tool:Win32/ScreenConnect",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Tool:Win32/ScreenConnect"
    },
    {
      "name": "MITRE ATT&CK - Remote Access Software (T1219)",
      "url": "https://attack.mitre.org/techniques/T1219/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}