Attackers Hijack Legitimate IT Admin Tool to Deploy Stealthy Remote Access
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors exploited user trust in a legitimate endpoint management platform (Faronics Deploy) by crafting convincing phishing lures that tricked users into enrolling their machines into an attacker-controlled deployment environment. Once enrolled, the attackers leveraged the tool's own trusted administrative features to silently install ConnectWise ScreenConnect, establishing persistent remote access that blends in with normal IT operations. This attack is particularly dangerous because it weaponizes legitimate software, making it harder for security tools and analysts to flag the activity as malicious. It highlights the critical gap between end-user awareness of phishing tactics and the catastrophic access an attacker can gain by abusing trusted administrative tooling.
Tactical Insight
Immediate actions
- Block or alert on unauthorized enrollment of endpoints into new remote management platforms via endpoint detection rules.
- Audit all currently installed remote access tools (RATs, RMMs) across your environment and remove any not explicitly approved.
- Deploy email security controls (DMARC, sandboxing, URL filtering) to intercept phishing emails impersonating software vendors.
Long-term improvements
- Maintain a strict allowlist of approved remote management tools and enforce policy that prevents installation of unapproved RMM software.
- Implement application control policies (e.g., AppLocker, WDAC) to prevent unauthorized executables from running, even if disguised as legitimate installers.
- Establish a vendor software verification process requiring cryptographic signature validation before any admin tool installer is executed.
Detection measures
- Monitor for unexpected outbound connections to known ScreenConnect, AnyDesk, or other RMM infrastructure using network-layer threat intelligence feeds.
- Alert on processes spawned by endpoint management agents (e.g., Faronics) that initiate installation of secondary remote access software.
- Conduct regular user phishing simulation exercises focused on software-themed lures to measure and improve end-user resilience.