[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYTtuIbkbk_XjYaKeHMfoZr77WQaZ_c2fhgZGuJP1rSA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"141ff2eb-7db6-47ae-940d-920616455435","attackers-hijack-legitimate-it-admin-tool-to-deploy-stealthy-remote-access","1376a1fb-fa50-4346-8da0-39c98c92bf1f","Attackers Hijack Legitimate IT Admin Tool to Deploy Stealthy Remote Access","Threat actors exploited user trust in a legitimate endpoint management platform (Faronics Deploy) by crafting convincing phishing lures that tricked users into enrolling their machines into an attacker-controlled deployment environment. Once enrolled, the attackers leveraged the tool's own trusted administrative features to silently install ConnectWise ScreenConnect, establishing persistent remote access that blends in with normal IT operations. This attack is particularly dangerous because it weaponizes legitimate software, making it harder for security tools and analysts to flag the activity as malicious. It highlights the critical gap between end-user awareness of phishing tactics and the catastrophic access an attacker can gain by abusing trusted administrative tooling.","**Immediate actions:**\n- Block or alert on unauthorized enrollment of endpoints into new remote management platforms via endpoint detection rules.\n- Audit all currently installed remote access tools (RATs, RMMs) across your environment and remove any not explicitly approved.\n- Deploy email security controls (DMARC, sandboxing, URL filtering) to intercept phishing emails impersonating software vendors.\n\n**Long-term improvements:**\n- Maintain a strict allowlist of approved remote management tools and enforce policy that prevents installation of unapproved RMM software.\n- Implement application control policies (e.g., AppLocker, WDAC) to prevent unauthorized executables from running, even if disguised as legitimate installers.\n- Establish a vendor software verification process requiring cryptographic signature validation before any admin tool installer is executed.\n\n**Detection measures:**\n- Monitor for unexpected outbound connections to known ScreenConnect, AnyDesk, or other RMM infrastructure using network-layer threat intelligence feeds.\n- Alert on processes spawned by endpoint management agents (e.g., Faronics) that initiate installation of secondary remote access software.\n- Conduct regular user phishing simulation exercises focused on software-themed lures to measure and improve end-user resilience.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-9: External System Services","NIST CSF PR.AT-1: Security Awareness Training","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1072: Software Deployment Tools",{},"published","2026-09-01T22:21:17.987091+00:00","2026-09-01T22:21:17.886+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect\u002F","hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect-da2eb2","Hackers abuse Faronics Deploy admin tool to install ScreenConnect",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":62,"name":63,"problem":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]