[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK6SsqRVK4rBmdCWMw4cxDK4lPE4KojZ7KjrdpLOdRQ0":3},{"article":4,"iocs":53,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1376a1fb-fa50-4346-8da0-39c98c92bf1f","Hackers abuse Faronics Deploy admin tool to install ScreenConnect","hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect-da2eb2","Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. [...]","Threat actors are abusing the legitimate Faronics Deploy endpoint management tool to gain remote administrative control over victim computers. Phishing emails with Faronics-themed lures are used to trick users into downloading a malicious Faronics installer, which enrolls their machine into an attacker-controlled deployment. The attackers then use Faronics' remote deployment features to execute scripts that install ConnectWise ScreenConnect, establishing a persistent remote access channel.","Hackers exploit Faronics Deploy to install ScreenConnect on victim endpoints.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F09\u002F03\u002Fdata-theft.jpeg","2026-09-01T20:53:23+00:00","2026-09-01T22:00:16.438149+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"Faronics Deploy","product",{"name":21,"type":19},"ScreenConnect",{"name":23,"type":24},"Faronics","vendor",{"name":26,"type":24},"Huntress",{"name":28,"type":29},"PowerShell","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54],{"type":45,"value":21,"context":55},"Remote access tool installed by attackers.",[23,26,18],{"controls":58,"vendors":142},[59,85,113],{"slug":60,"name":61,"problem":62,"products":63},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":81,"product_name":82,"url":83,"description":84},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,105],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":99,"vendor_name":26,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[143],{"slug":99,"name":26,"logo_path":100,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":163},"attackers-hijack-legitimate-it-admin-tool-to-deploy-stealthy-remote-access","Attackers Hijack Legitimate IT Admin Tool to Deploy Stealthy Remote Access","Threat actors exploited user trust in a legitimate endpoint management platform (Faronics Deploy) by crafting convincing phishing lures that tricked users into enrolling their machines into an attacker-controlled deployment environment. Once enrolled, the attackers leveraged the tool's own trusted administrative features to silently install ConnectWise ScreenConnect, establishing persistent remote access that blends in with normal IT operations. This attack is particularly dangerous because it weaponizes legitimate software, making it harder for security tools and analysts to flag the activity as malicious. It highlights the critical gap between end-user awareness of phishing tactics and the catastrophic access an attacker can gain by abusing trusted administrative tooling.",[151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-9: External System Services","NIST CSF PR.AT-1: Security Awareness Training","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1072: Software Deployment Tools",{}]