Faronics Deploy Abused in ScreenConnect Attacks

Huntress researchers have uncovered a phishing campaign that abuses a legitimate endpoint management platform to gain remote control over victim computers. The attacks, observed between July 21 and August 20, used Faronics-themed lures to trick users into downloading a signed installer, ultimately leading to the installation of a second remote access tool.

Phishing Lures and Malicious Downloads

According to Huntress, the campaign targeted more than 457 endpoints with emails disguised as invoices, tax documents, or other business files. The embedded malicious links lead to a website that profiles potential targets and guides them through a malicious download flow.

If the website detects an analysis environment, it activates a decoy routine, such as displaying an error message, to evade detection. Potential victims are prompted to download and launch a legitimate, signed Faronics Deploy installer, often disguised as an Adobe document, a reader app, or a plugin update.

Enrolling Victims in Attacker-Controlled Deployment

When the victim runs the installer—often named 'Adobe.exe'—their computer is enrolled in a Faronics deployment controlled by the attackers. Faronics Deploy is a cloud-based endpoint management platform that allows IT administrators to remotely enroll and manage computers, deploy software, and execute scripts.

The threat actor then uses Faronics' remote-deployment functionality to execute PowerShell scripts on the enrolled computer without further user interaction. These scripts download additional tools from the attacker's infrastructure or external locations, including GitHub.

Installing ScreenConnect for Redundancy

Eventually, the scripts install another legitimate remote access tool, ConnectWise ScreenConnect. According to Huntress, the delivery method varies between scripts, with observed examples using curl or mshta to retrieve additional content, while others invoke msiexec to install payloads hosted on attacker-controlled infrastructure.

“These scripts are subsequently used to install ScreenConnect, establishing an additional remote access mechanism on the compromised endpoint.”

— Huntress, managed detection and response company

ScreenConnect gives attackers an additional remote-access channel independent of Faronics, providing hands-on remote control better suited to interactive access. It also serves as redundancy if the malicious Faronics deployment is identified and terminated, or if defenders remove its agent.

Huntress Notifies Faronics

Huntress notified Faronics of its findings on August 5, and the vendor confirmed the observed malicious activity. Faronics countered the abuse by implementing additional anti-abuse measures and has contacted victimized organizations to notify them about potential compromise.

According to Huntress, the malicious activity dropped significantly starting August 21, indicating that Faronics' actions worked.

Recommendations for Administrators

Huntress recommends that administrators check the "C:\ProgramData\Faronics\Logs\" location for a ScriptRunner.log file, which may preserve remotely executed script names and download URLs. The company says that the ck parameter in Faronics configuration requests is also an indicator, as it identifies the associated customer deployment and can help identify compromised endpoints or malicious accounts.

Administrators should also look for ScreenConnect installations where it is not normally deployed.

Why This Matters

This campaign highlights how attackers can turn trusted administrative tools into malicious ones, leveraging signed, legitimate software to bypass security controls. For organizations, this means even reputable endpoint management platforms can be abused, and the presence of unexpected remote access tools should be treated as a potential red flag.

The attackers' use of a legitimate platform for initial access and a secondary tool for redundancy suggests a sophisticated approach that could have broader implications for how similar attacks are detected. As Huntress's data shows, the activities drop significantly after vendor intervention, but the underlying tactics could be adapted by other threat actors.