Full Report
Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. [...]
Analysis Summary
# Tool/Technique: Abusing Faronics Deploy for ScreenConnect Persistence
## Overview
This technique involves the abuse of the legitimate cloud-based endpoint management platform **Faronics Deploy** to gain administrative control over target systems. Attackers use social engineering (phishing) to trick users into enrolling their devices into an attacker-controlled Faronics instance, which is then used to deploy secondary remote access tools (RATs) like **ConnectWise ScreenConnect** for persistent, interactive access.
## Technical Details
- **Type:** Living-off-the-Land (LotL) / Tool Abuse
- **Platform:** Windows (primarily)
- **Capabilities:** Remote software deployment, script execution (PowerShell), system enrollment, administrative remote control.
- **First Seen:** Observed active between July 21 and August 20, 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1218.005 - System Binary Proxy Execution: Mshta]
- **[TA0005 - Defense Evasion]**
- [T1202 - Indirect Command Execution]
- [T1036.005 - Masquerading: Match Legitimate Name or Location]
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software]
## Functionality
### Core Capabilities
- **Remote Enrollment:** Tricking victims into running a signed, legitimate Faronics Deploy agent that connects the machine to the attacker’s management console.
- **Software Deployment:** Using the platform’s native features to push MSI installers (like ScreenConnect) to all enrolled endpoints.
- **Script Execution:** Running PowerShell scripts remotely to automate the retrieval of additional payloads.
### Advanced Features
- **Environment Profiling:** The malicious landing pages profile the visitor; if an analysis or sandbox environment is detected, the site serves a decoy error message instead of the payload.
- **Redundant Access:** By installing ScreenConnect as a secondary layer, attackers maintain access even if the Faronics deployment is identified and revoked.
- **Trusted Binaries:** The use of a legitimate, digitally signed Faronics installer helps bypass security products that rely on file reputation or signature validity.
## Indicators of Compromise
- **File Names:**
- `Adobe.exe` (Faronics installer disguised as Adobe)
- `ScriptRunner.log` (Located in the Faronics log directory)
- **Registry/Configuration:**
- The `ck` parameter in Faronics configuration requests (unique identifier for the malicious deployment account).
- **Network Indicators:**
- Downloads originating from `github[.]com` via scripts.
- Connections to `faronics[.]com` subdomains associated with unauthorized accounts.
- **Behavioral Indicators:**
- Execution of `curl`, `mshta`, or `msiexec` initiated by the Faronics agent process.
- Unexpected installation of ScreenConnect in environments where it is not a standard business tool.
## Associated Threat Actors
- Unknown (General Phishing/Ransomware Initial Access Brokers).
## Detection Methods
- **Signature-based:** Detection of the `ck` parameter associated with known malicious Faronics accounts.
- **Behavioral detection:** Monitoring for `ScriptRunner.exe` or the Faronics agent spawning shells (`powershell.exe`, `cmd.exe`) or network-aware utilities (`curl.exe`).
- **Log Analysis:** Monitoring `C:\ProgramData\Faronics\Logs\ScriptRunner.log` for suspicious URLs or script names.
## Mitigation Strategies
- **Application Whitelisting:** Restrict the execution of remote management tools to only those explicitly approved by the organization.
- **Network Filtering:** Block unauthorized access to the Faronics Deploy dashboard and associated URLs if the tool is not used by the organization.
- **User Training:** Educate users on identifying "download flows" that profile their system or require running executables for simple document viewing.
- **System Hardening:** Disable or monitor the use of `mshta.exe` and `msiexec.exe` when called by non-standard parent processes.
## Related Tools/Techniques
- **ScreenConnect (ConnectWise):** Legitimate remote support software frequently abused for C2.
- **Atera / AnyDesk / TeamViewer Abuse:** Similar techniques involving the use of legitimate RMM (Remote Monitoring and Management) tools for malicious persistence.