Faronics Deploy Abused for Malicious Remote Access Deployment
Security researchers have uncovered a concerning new tactic employed by phishing actors: the abuse of Faronics Deploy, a legitimate endpoint management platform, to install ScreenConnect, a widely used remote support tool, on compromised victim computers. This method allows attackers to gain persistent, administrative-level remote access to targeted systems, posing a severe threat to organizational security and data integrity.
Faronics Deploy is designed to help IT administrators manage and deploy software, updates, and configurations across multiple endpoints within an organization. Its legitimate function involves pushing software packages and scripts to networked computers. Attackers are exploiting this functionality by crafting malicious payloads that, when executed via Faronics Deploy, install ScreenConnect. ScreenConnect, now known as ConnectWise Control, is a powerful remote access tool that, when used legitimately, enables IT professionals to provide remote support and manage systems. However, in the hands of attackers, it becomes a potent tool for lateral movement, data exfiltration, and establishing deeper footholds within a network.
The sophistication of this attack lies in its use of a trusted tool. By leveraging Faronics Deploy, attackers can bypass initial security measures that might flag unauthorized software installations or network access attempts. The legitimate administrative privileges granted to Faronics Deploy are co-opted by the threat actors, allowing them to execute arbitrary code and install the ScreenConnect client without raising immediate alarms. This circumvents the need for traditional exploits that target software vulnerabilities, instead relying on the weaponization of administrative functionality.
The attackers' primary vector for initial compromise appears to be phishing. Once a user falls victim to a phishing campaign, the attackers can then utilize their access to deploy Faronics Deploy agents or directly access existing Faronics Deploy installations within the victim's network. From there, they can initiate the silent installation of ScreenConnect, effectively turning a legitimate administrative tool into a backdoor for their own remote access.
The Technical Execution and Implications
While the exact technical steps may vary, the general principle involves an attacker gaining initial access to a network, potentially through compromised credentials or malware delivered via phishing. Once inside, they identify or compromise a system with Faronics Deploy installed and administrative control. The attackers then craft a package or script that, when deployed through Faronics Deploy, downloads and installs the ScreenConnect client. This client then connects to a command-and-control (C2) server operated by the attackers, providing them with unattended remote access.
The implications of this attack are far-reaching. Organizations relying on Faronics Deploy for legitimate IT management could find their systems compromised without realizing it until significant damage has been done. The presence of unauthorized ScreenConnect instances can lead to:
- Unauthorized Data Access and Exfiltration: Attackers can browse file systems, steal sensitive information, and exfiltrate it from the network.
- Lateral Movement: Using the compromised machine as a pivot point, attackers can move deeper into the network, targeting other systems and servers.
- System Disruption: Attackers can modify system configurations, disable security software, or deploy ransomware.
- Persistence: ScreenConnect, once installed, can be configured to maintain persistence, ensuring the attacker retains access even after reboots or network changes.
The use of ScreenConnect is particularly noteworthy. It's a legitimate and powerful tool, often whitelisted by security solutions. This makes its unauthorized deployment harder to detect than the installation of more overtly malicious software. Attackers are essentially using a tool designed for IT support to facilitate cybercrime.
Mitigation and Detection Strategies
Addressing this threat requires a multi-layered approach, focusing on both preventing the initial compromise and detecting the unauthorized use of administrative tools.
Network and Endpoint Security
- Harden Faronics Deploy Installations: Ensure Faronics Deploy is configured with strong, unique administrative passwords. Restrict access to only necessary personnel and systems. Regularly audit Faronics Deploy logs for unusual deployment activities.
- Monitor Deployments: Implement strict change control and monitoring for all software deployments initiated through Faronics Deploy. Any deployment not initiated by authorized IT personnel should be treated as suspicious.
- Endpoint Detection and Response (EDR): Deploy robust EDR solutions that can monitor for the installation of unauthorized software, unusual process execution, and network connections to known malicious C2 servers. EDR tools can often detect the ScreenConnect installer or its post-installation network activity.
- Network Traffic Analysis: Monitor outbound network traffic for connections to known ScreenConnect C2 infrastructure or unusual patterns indicative of remote access.
User and Access Management
- Phishing Awareness Training: Continuously train users to recognize and report phishing attempts. This is the primary vector for initial compromise and must be a focus.
- Principle of Least Privilege: Ensure that administrative tools like Faronics Deploy are only granted the minimum necessary privileges. Avoid using domain administrator accounts for routine management tasks where possible.
- Regular Audits: Conduct regular security audits of all administrative tools and their configurations, looking for unauthorized installations or changes.
What remains unclear is the extent to which this specific abuse of Faronics Deploy has become widespread. While BleepingComputer's report highlights the tactic, the full scope of networks potentially affected by this method is not yet known. Organizations using Faronics Deploy should proactively review their configurations and logs for any signs of unauthorized activity.