Hackers Exploit Faronics Deploy to Install ScreenConnect Remote Tool

How the Attack Chain Works

Threat actors start with a phishing email that contains a malicious attachment or a link to a counterfeit login page. When a user enters credentials, the attackers obtain valid administrative accounts for the Faronics Deploy console. With those privileges they can create or modify deployment packages that include the ScreenConnect installer. The compromised package is then pushed to enrolled endpoints, where the remote support client runs silently and opens a backdoor for the attackers.

The steps can be summarized as follows:

1. Phishing email delivers credential‑stealing payload.
2. Attacker logs into the Deploy console using stolen admin credentials.
3. Malicious deployment package is crafted to include ScreenConnect.
4. Package is distributed to all managed devices.
5. ScreenConnect installs and connects to the attacker‑controlled server.

Why Faronics Deploy Is Attractive to Attackers

Faronics Deploy is an endpoint management solution used by schools, small businesses and managed service providers. It provides a single pane of glass for software distribution, patch management and remote control. Because it operates with high privileges, compromising the console gives an adversary the ability to execute code on any device that is enrolled.

Key factors that make the platform a target include:

• Widespread deployment in environments with limited security staffing.
• Built‑in mechanisms for silent software installation.
• Integration with Windows authentication, which can be abused if credentials are leaked.

When attackers gain access, they can move laterally across the entire network without triggering typical alerts.

The Role of ScreenConnect in the Breach

ScreenConnect, now marketed as ConnectWise Control, is a legitimate remote support tool. It is designed to let technicians access a user’s desktop for troubleshooting. In the hands of a threat actor, the same functionality becomes a powerful remote access trojan.

Once installed, ScreenConnect creates an outbound TLS connection to a command and control server controlled by the attacker. Because the traffic is encrypted and appears as normal remote support traffic, many network monitoring solutions fail to flag it.

Features that make ScreenConnect attractive for abuse include:

• Ability to run without user interaction after initial deployment.
• Support for persistent sessions that survive reboots.
• Built‑in file transfer and command execution capabilities.

Mitigation Steps for IT Administrators

Organizations that rely on Faronics Deploy should take immediate actions to reduce exposure.

• Rotate administrative passwords on the Deploy console and enforce multi‑factor authentication where possible.
• Audit deployment packages for unexpected binaries or scripts. Verify checksums against known good versions.
• Restrict network access for the Deploy server. Only allow connections from trusted management workstations.
• Enable logging for all package distribution events and review logs for anomalies.
• Update both Faronics Deploy and ScreenConnect to the latest patches released by the vendors.

Additional hardening measures can be found in the NIST guidance on endpoint security. Implementing network segmentation and restricting outbound connections to known remote support providers also helps contain potential abuse.

Detecting Compromised Deploy Agents

Detecting a malicious ScreenConnect installation requires a combination of endpoint monitoring and network analysis.

• Search for the ScreenConnect service name in Windows services lists.
• Monitor outbound TLS connections to domains that are not part of the official ConnectWise infrastructure.
• Use MITRE ATT&CK technique T1190 to map the observed behavior to known remote access patterns.
• Leverage US‑CERT alerts for emerging indicators of compromise related to remote support tools.

Endpoint detection platforms that can flag the creation of new scheduled tasks or services associated with ScreenConnect provide an additional safety net.

Regularly reviewing the Faronics Deploy official documentation for best practices and security hardening tips ensures that administrators stay aligned with the vendor’s recommendations.

Finally, keeping an eye on the ConnectWise ScreenConnect product page for security advisories helps organizations apply patches before attackers can exploit known vulnerabilities.