[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f98uBTFMNFQIoRTXskzURpvL1NMJouCSIIbeo7x7GDA8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"90bcac82-f09a-4617-a36e-602f2e4e4584","crypto-exchange-names-used-to-mask-unauthorized-screenconnect-sessions","8f7cf594-4b31-49f3-bbb7-455209773205","Crypto Exchange Names Used to Mask Unauthorized ScreenConnect Sessions","Attackers exploited publicly accessible guest installer links on over 118 ScreenConnect servers to register more than 2,200 unauthorized remote sessions, disguising them with legitimate-sounding crypto exchange names to avoid suspicion. The core failure was that guest access was left open without adequate restrictions or vetting, allowing anyone to create sessions that blended in with normal activity. Because monitoring was insufficient, these sessions persisted for over 10 days before discovery, and in at least one case a technician unknowingly sent keystrokes to a fraudulent session, risking credential exposure. This incident illustrates how permissive remote access configurations combined with weak session visibility can create a stealthy foothold for attackers before any overtly malicious action is even taken.","**Immediate actions:**\n- Audit and disable all publicly accessible guest installer links on ScreenConnect servers that are not explicitly required for business operations.\n- Review all active and recent ScreenConnect sessions for unrecognized or suspicious names and terminate unauthorized ones immediately.\n\n**Long-term improvements:**\n- Restrict session creation to authenticated, approved users only and enforce allowlisting of permitted session names or organizations.\n- Implement multi-factor authentication for all ScreenConnect administrator and technician accounts to prevent misuse of legitimate credentials.\n- Establish a formal review process for remote access tool configurations as part of periodic security assessments.\n\n**Detection measures:**\n- Deploy alerting for unusual session creation patterns, including sessions with names matching external organizations or high session volume spikes.\n- Maintain comprehensive audit logs of all ScreenConnect session activity and integrate them into a SIEM for continuous monitoring and anomaly detection.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"NIST SP 800-53 AC-17: Remote Access":19,"CIS Control 6: Access Control Management (v8)":20,"NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":22},"NIS2 Article 21(2)(i) covers access control and asset management, directly requiring that remote access tools have proper controls preventing unauthorized parties from registering sessions.","AC-17 requires organizations to control and monitor remote access methods, which would have mandated restrictions on who can initiate ScreenConnect sessions and under what conditions.","CIS Control 6 requires that access to systems be granted only to authorized users, which would have prevented unauthenticated external parties from creating sessions on ScreenConnect servers.","AU-6 requires regular review of audit logs for indicators of inappropriate activity, which would have surfaced the 2,200 suspicious sessions far sooner than 10 days after they appeared.","CIS Control 4 requires hardening software configurations, including disabling unnecessary or publicly exposed features like open guest installer links that enabled attackers to register unauthorized sessions.","published","2026-11-14T00:20:22.544347+00:00","2026-11-14T00:20:22.527+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Ffake-crypto-exchange-sessions-screenconnect","attackers-use-crypto-exchange-names-to-disguise-unauthorized-sessions-on-100-scr-a14b22","Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]