Faronics Deploy Abused by Phishing Actors to Install ScreenConnect

2026-09-02 01:58 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Phishing attacks leveraging Faronics Deploy grant attackers persistent remote administrative access to victim endpoints, enabling further tool deployment.
Endpoints managed by Faronics Deploy are susceptible if users are tricked into installing a malicious, signed Faronics installer.
Monitor Faronics Deploy logs and configurations for suspicious script executions and unauthorized ScreenConnect installations.

Overview: Phishing Campaign Leverages Faronics Deploy for Persistent Access

Threat actors are actively abusing the legitimate Faronics Deploy endpoint management platform to establish persistent remote administrative control over victim systems, ultimately installing ConnectWise ScreenConnect remote support software. This campaign, observed by managed detection and response (MDR) company Huntress between July 21 and August 20, 2024, utilized Faronics-themed phishing lures delivered via email. These emails, disguised as invoices, tax documents, or other business-related files, targeted more than 457 endpoints, according to BleepingComputer. The sophisticated nature of this attack, which involves the subversion of a trusted administrative tool, highlights the evolving tactics of threat actors to bypass conventional security measures.

Technical Analysis: How Attackers Abuse Faronics Deploy

The attack chain begins with a carefully crafted phishing email containing a malicious link. Upon clicking, victims are redirected to a website that profiles potential targets. Notably, this site employs anti-analysis techniques, displaying error messages or decoy routines if accessed from a security research environment, demonstrating a clear attempt by the threat actors to evade detection. If the target is deemed suitable, they are prompted to download and launch a legitimate, digitally signed Faronics Deploy installer. This installer is often cleverly disguised as an innocuous file, such as an Adobe document, a reader application, or a plugin update, frequently named Adobe.exe.

Once the victim executes this seemingly legitimate Faronics installer, their computer is covertly enrolled into a Faronics deployment controlled entirely by the attackers. This grants the threat actor a foundational level of remote access and control. With the victim’s endpoint now under their Faronics management, the attackers leverage Faronics’ inherent remote-deployment functionality to execute arbitrary PowerShell scripts without requiring further user interaction. These scripts serve as the next stage of the attack, downloading additional malicious tools from attacker-controlled infrastructure or external sources like GitHub. The primary objective of these scripts is to install ConnectWise ScreenConnect, another legitimate remote access tool.

The installation of ScreenConnect provides the attackers with a critical secondary channel for remote access. This offers redundancy, ensuring continued control even if the malicious Faronics deployment is identified and remediated or its agent removed. Furthermore, ScreenConnect typically offers more interactive hands-on remote capabilities, making it a preferred tool for in-depth system compromise and data exfiltration, explaining why threat actors often transition to it after initial access.

Huntress reported their findings to Faronics on August 5, 2024. Faronics promptly confirmed the malicious activity and implemented additional anti-abuse measures. They also took the proactive step of notifying victimized organizations. These swift actions led to a significant reduction in observed malicious activity starting August 21, indicating the effectiveness of Faronics’ countermeasures in mitigating this particular campaign.

Recommendations: Detecting and Mitigating Faronics Deploy Abuse

Organizations leveraging Faronics Deploy should immediately implement enhanced monitoring and detection strategies to identify and respond to similar abuses. Understanding how to detect Faronics Deploy abuse is crucial for preventing broader network compromise.

Here are key recommendations for defenders:

Log Analysis for ScriptRunner.log: Administrators should meticulously check the C:\ProgramData\Faronics\Logs\ScriptRunner.log file. This log location may preserve records of remotely executed script names and their associated download URLs, providing direct indicators of compromise.
Monitor Faronics Configuration Requests: Pay close attention to the ck parameter in Faronics configuration requests. This parameter identifies the associated customer deployment and can be instrumental in identifying compromised endpoints or malicious accounts used in phishing attacks abusing legitimate admin tools.
Unauthorized ScreenConnect Installations: Actively scan for and investigate any instances of ConnectWise ScreenConnect installed on endpoints where it is not officially deployed or authorized. Unauthorized ScreenConnect installation indicators are a strong sign of compromise, as attackers frequently use it for persistent remote access.
User Education: Reinforce user training on identifying and reporting phishing attempts, especially those disguised as legitimate business documents or software updates. Emphasize caution with any requests to download and execute installers from unverified sources, even if they appear to be signed by a trusted vendor.
Endpoint Detection and Response (EDR): Ensure EDR solutions are configured to detect suspicious process execution, particularly PowerShell scripts initiating connections to unusual domains or downloading executables. EDR can help identify actions taken post-initial access, where traditional prevention mechanisms may fail if valid credentials or legitimate tools are abused.

#Phishing #PowerShell

X/Twitter LinkedIn Reddit HN

← Back to Articles