Actor Profile

The threat actors are unattributed phishing operators leveraging social engineering and legitimate administrative tools for unauthorized remote access. Their motivation appears to be establishing persistent remote control over corporate endpoints for potential data theft, credential harvesting, or follow-on intrusion activities. The actors demonstrated operational sophistication through environment-aware delivery infrastructure that fingerprints victims and deploys decoy routines when accessed from analysis environments. Between July 21 and August 20, 2026, the campaign reached over 457 endpoints using business-themed lures (invoices, tax documents). The actors' use of dual legitimate remote access tools (Faronics Deploy and ConnectWise ScreenConnect) indicates a focus on operational redundancy and evasion of security controls.

TTPs (Tactics, Techniques, Procedures)

Initial access achieved via phishing emails with malicious links disguised as business documents (T1566.002 - Phishing: Spearphishing Link). Victims directed to profiling websites that fingerprint analysis environments and serve environment-specific content (T1497 - Virtualization/Sandbox Evasion). Delivery of signed, legitimate Faronics Deploy installer masquerading as Adobe software (T1036.005 - Masquerading: Match Legitimate Name or Location, T1553.002 - Subvert Trust Controls: Code Signing). Enrollment of victim endpoints into attacker-controlled Faronics deployment for remote command execution (T1219 - Remote Access Software). PowerShell script execution for payload delivery (T1059.001 - Command and Scripting Interpreter: PowerShell) using curl, mshta, or msiexec (T1105 - Ingress Tool Transfer). Installation of ConnectWise ScreenConnect for redundant remote access and hands-on keyboard control (T1219). Hosting of payloads on attacker infrastructure and legitimate services like GitHub (T1608.001 - Stage Capabilities: Upload Malware).

Targets & Patterns

The campaign targeted corporate endpoints across multiple organizations, with 457+ affected systems observed. Phishing lures themed around invoices, tax documents, and business files suggest targeting of finance, accounting, and general business operations personnel who regularly handle such documents. The abuse of endpoint management platforms indicates the actors sought organizations where IT administrative tools might be expected, reducing suspicion. The use of Adobe-themed lures and fake download pages suggests targeting of users likely to interact with PDF documents and software updates. No specific geographic or vertical sector concentration was identified in available data, suggesting opportunistic targeting based on successful phishing rather than focused intelligence collection against specific industries.

Historical Context

This campaign represents a continuation of the broader trend of threat actors abusing legitimate remote management and support tools (living-off-the-land binaries and legitimate software abuse) to evade detection. ScreenConnect has been previously abused by multiple threat actors including ransomware operators, and its use here follows established patterns of deploying dual remote access mechanisms for redundancy. The use of signed legitimate installers for initial compromise aligns with techniques observed across multiple phishing campaigns in 2025-2026. Faronics confirmed the malicious activity and implemented anti-abuse measures on August 5, 2026, with malicious activity dropping significantly by August 21, indicating effective vendor response. This represents one of the first publicly documented cases of Faronics Deploy platform abuse for malicious purposes.

Defensive Recommendations

  • Monitor for unexpected Faronics Deploy installations and check C:\ProgramData\Faronics\Logs\ScriptRunner.log for evidence of remotely executed scripts and suspicious download URLs
  • Detect T1059.001 PowerShell execution via Sysmon Event ID 1 and scrutinize PowerShell scripts invoking curl, mshta, or msiexec for external content retrieval (T1105)
  • Audit ScreenConnect installations across the environment and alert on deployments to endpoints where remote support tools are not authorized or expected
  • Implement email security controls to detect and block phishing lures with links to profiling/fingerprinting infrastructure, particularly those masquerading as business documents
  • Monitor for enrollment of endpoints into external or unauthorized endpoint management platforms by tracking outbound connections to Faronics Deploy infrastructure and analyzing the 'ck' parameter in configuration requests to identify malicious customer deployments