Actor Profile

The actors are unattributed phishing operators conducting opportunistic attacks against organizations using social engineering lures. Between July 21 and August 20, 2026, they targeted over 457 endpoints with phishing emails disguised as invoices, tax documents, and other business files. Their motivation appears to be gaining persistent remote administrative access to victim environments. The campaign leverages abuse of legitimate IT management tools rather than custom malware, indicating a focus on operational security and evasion. No specific threat actor group, nation-state affiliation, or cybercrime gang has been publicly attributed to this activity.

TTPs (Tactics, Techniques, Procedures)

The actors employ multi-stage social engineering and living-off-the-land techniques. Initial access is achieved via phishing emails (T1566.002 - Phishing: Spearphishing Link) containing malicious links to profiling websites. The sites perform environment detection to evade analysis (T1497 - Virtualization/Sandbox Evasion) and deliver a legitimate, signed Faronics Deploy installer masquerading as Adobe software. Once executed, the victim's endpoint is enrolled in an attacker-controlled Faronics deployment. The actors then abuse Faronics' legitimate functionality to execute PowerShell scripts remotely (T1059.001 - Command and Scripting Interpreter: PowerShell) without further user interaction. These scripts use curl, mshta (T1218.005 - System Binary Proxy Execution: Mshta), or msiexec to download and install ConnectWise ScreenConnect for persistent remote access (T1219 - Remote Access Software). This establishes redundant command and control channels independent of the initial Faronics deployment.

Targets & Patterns

The campaign targeted a broad range of organizations without apparent sector-specific focus, reaching 457+ endpoints across multiple victims. The use of generic business lures (invoices, tax documents) suggests opportunistic targeting rather than tailored spearphishing. Victims are organizations that could plausibly receive Faronics Deploy or Adobe-related communications, indicating the actors rely on social engineering credibility rather than reconnaissance. The attack pattern suggests targeting of small to mid-sized organizations that may lack robust email filtering and endpoint detection capabilities. The choice of Faronics Deploy—a legitimate IT management platform—indicates the actors seek environments where remote management tools might not trigger immediate suspicion, allowing for prolonged access and lateral movement opportunities.

Historical Context

This campaign represents a continuation of the broader trend of threat actors abusing legitimate remote management and monitoring (RMM) tools observed throughout 2025-2026. Similar techniques have been documented with AnyDesk, TeamViewer, and other remote access platforms. The use of signed, legitimate software to bypass security controls mirrors tactics seen in software supply chain compromises and LOLBin (Living Off the Land Binaries) abuse. The Faronics vendor response—implementing anti-abuse measures and victim notification starting August 5, 2026—resulted in a significant activity drop by August 21, suggesting the campaign was disrupted rather than concluded organically. No direct links to previously named campaigns or threat actor groups have been established in available reporting.

Defensive Recommendations

  • Monitor for unexpected Faronics Deploy installations and check C:\ProgramData\Faronics\Logs\ScriptRunner.log for evidence of remotely executed scripts and suspicious download URLs
  • Detect T1059.001 PowerShell execution via enhanced logging (Sysmon Event ID 1, PowerShell Script Block Logging Event ID 4104) and alert on curl, mshta, or msiexec invocations downloading from external or GitHub-hosted resources
  • Implement application allowlisting to prevent execution of unexpected RMM tools like ScreenConnect in environments where they are not authorized, and audit existing ScreenConnect installations for unauthorized instances
  • Deploy email security controls to block phishing links and implement URL sandboxing to detect environment-aware malicious sites that display decoy content to analysis tools
  • Investigate Faronics configuration requests for suspicious 'ck' parameter values that may indicate enrollment in attacker-controlled deployments, and correlate with endpoint telemetry for unauthorized remote access tool installations