Fake "View & Sign" document pages and Adobe Acrobat lures are handing out genuine, digitally signed ConnectWise ScreenConnect installers that are pre-configured to connect to an outside account, giving whoever controls it persistent remote access to any Windows PC that runs one.
Gagan Aggarwal of CloudSEK described the activity in the original report. The installers are not trojanized. The danger lies entirely in their settings, which is why CloudSEK warns that blocking file hashes will not be enough.
A real tool, pointed at the wrong tenant
ScreenConnect is a widely used remote support product, and each customer runs its own cloud tenant. The two installers CloudSEK collected from the Adobe-themed lure at clickksy[.]icu were signed by ConnectWise, LLC, but carried embedded configuration pointing at two outside tenants, omydze and vvvzou. Static analysis showed they install a service called ScreenConnect Client followed by a 16-character fingerprint, which starts automatically and runs as LocalSystem, a highly privileged Windows account.
Eight more URLs led CloudSEK to a related cluster of "View & Sign Form" pages in five variants with near-identical code. Before offering a download, the pages check the visitor's operating system and redirect anyone not on a Windows desktop, look up the visitor's IP address and location, and send those details to Telegram bots (four bot and chat pairs appear in the code). Downloads can be suppressed for selected internet providers, which CloudSEK says is consistent with dodging automated analysis. Labels such as "Candidate Information downloaded successfully" hint at a recruitment pretext. One page redirected non-Windows visitors to the Adobe lure, linking the two patterns with moderate confidence.
CloudSEK is careful about what it does not know. No victim compromise was confirmed, the emails or links that drew people to the pages were not found, and the shared kit could be one operator rotating infrastructure or several using copied tooling. Tenants seen across the cluster also included luminahealthturkey2, tfcconnection and alunos1.
Hunt for unapproved ScreenConnect tenants
CloudSEK's advice centres on the tenant, not the file. Inventory every ScreenConnect installation and flag any tenant your organization did not approve, hunt for services named ScreenConnect Client with a 16-hex-character fingerprint and matching sc-<fingerprint> URL protocol handlers, and alert on connections to ScreenConnect relay hosts for unlisted tenants. Use application control to restrict remote management tools to approved tenants. Where an unauthorized client turns up, isolate the machine, remove it, rotate credentials reachable from that host and review remote sessions and file transfers. CloudSEK also advises against broadly blocking shared ScreenConnect or Cloudflare infrastructure.
ScreenConnect has drawn attention for its own flaws too, as we reported when CISA set a three-day patch deadline. Here nothing is broken at all, which is exactly what makes a signed installer such a convenient disguise.
Indicators of compromise
- Lure domains: clickksy[.]icu, prependinganalysis[.]site, greenandverified[.]site, testedinception[.]site, interestinghub[.]site, intentionallydurable[.]site
- Origin IPs: 142[.]93[.]157[.]161, 144[.]126[.]224[.]49, 157[.]230[.]48[.]85, 161[.]35[.]120[.]164, 167[.]99[.]232[.]192
- Download pattern: ...screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest
- EXE SHA-256: e98a5f363645ab41597d73dc9df7859b154fb0a2a08e23623050c217e4f77d5d
- MSI SHA-256: 1552fa772ad501e9b7024a0952bbc30637be23778896492e372a9aee463fa06a
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.