[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKKzxTQfIacANpjmhNMtAwCGaYaHWmpbH_N1h3CjfioI":3},{"article":4,"iocs":41,"watch_terms":49,"solutions":50,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"8f7cf594-4b31-49f3-bbb7-455209773205","Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers","attackers-use-crypto-exchange-names-to-disguise-unauthorized-sessions-on-100-scr-a14b22","Fake crypto exchange sessions are showing up on ScreenConnect servers and could be bait for technicians. See what Huntress found and what to do.","Huntress discovered over 2,200 unauthorized ScreenConnect sessions on 118 servers, disguised with crypto exchange names. These sessions, appearing over 10 days, were registered using publicly accessible guest installers. While no malicious activity has been directly observed from these sessions, one instance involved a technician sending keystrokes to a fake session, raising concerns about potential credential exposure.","Attackers disguise unauthorized ScreenConnect sessions with crypto exchange names on 100+ servers.","https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Ffake-crypto-exchange-sessions-screenconnect","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F9d30f5f80495495a9cb9ee14e2c90d41","2026-11-14T01:50:00+00:00","2026-11-14T00:00:35.11456+00:00",7,[17,20],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"remote desktop software","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[42,46],{"type":43,"value":44,"context":45},"ip","74.208.158.106","Primary IP address for unauthorized ScreenConnect sessions",{"type":43,"value":47,"context":48},"197.47.160.252","Early IP address associated with unauthorized ScreenConnect sessions",[18],{"controls":51,"vendors":138},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":82,"name":83,"problem":84,"products":85},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[86,94,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":96,"url":99,"description":100},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[139],{"slug":131,"name":132,"logo_path":133,"roles":140},[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"crypto-exchange-names-used-to-mask-unauthorized-screenconnect-sessions","Crypto Exchange Names Used to Mask Unauthorized ScreenConnect Sessions","Attackers exploited publicly accessible guest installer links on over 118 ScreenConnect servers to register more than 2,200 unauthorized remote sessions, disguising them with legitimate-sounding crypto exchange names to avoid suspicion. The core failure was that guest access was left open without adequate restrictions or vetting, allowing anyone to create sessions that blended in with normal activity. Because monitoring was insufficient, these sessions persisted for over 10 days before discovery, and in at least one case a technician unknowingly sent keystrokes to a fraudulent session, risking credential exposure. This incident illustrates how permissive remote access configurations combined with weak session visibility can create a stealthy foothold for attackers before any overtly malicious action is even taken.",[147,148,149,150,151],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":153,"NIST SP 800-53 AC-17: Remote Access":154,"CIS Control 6: Access Control Management (v8)":155,"NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting":156,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":157},"NIS2 Article 21(2)(i) covers access control and asset management, directly requiring that remote access tools have proper controls preventing unauthorized parties from registering sessions.","AC-17 requires organizations to control and monitor remote access methods, which would have mandated restrictions on who can initiate ScreenConnect sessions and under what conditions.","CIS Control 6 requires that access to systems be granted only to authorized users, which would have prevented unauthenticated external parties from creating sessions on ScreenConnect servers.","AU-6 requires regular review of audit logs for indicators of inappropriate activity, which would have surfaced the 2,200 suspicious sessions far sooner than 10 days after they appeared.","CIS Control 4 requires hardening software configurations, including disabling unnecessary or publicly exposed features like open guest installer links that enabled attackers to register unauthorized sessions."]