Hackers abuse Faronics Deploy admin tool to install ScreenConnect

Attackers are exploiting the Faronics Deploy administrative tool, which is designed for endpoint management, to install ScreenConnect remote support software on victim machines. This technique allows threat actors to gain remote administrative access by abusing legitimate software functionality rather than exploiting a software vulnerability. The attack vector involves phishing to compromise credentials or access to the Faronics Deploy platform, which is then used to deploy ScreenConnect for persistent remote control.

The impact includes unauthorized remote administrative access to victim computers, which can lead to data compromise, lateral movement within networks, and further malicious activities. Since the attackers use legitimate software tools, detection and prevention may be more challenging, increasing the risk of prolonged unauthorized access.

No specific patch or fix is indicated for this issue as it involves abuse of legitimate software functionality rather than a software vulnerability. Organizations should focus on securing access to the Faronics Deploy platform by enforcing strong authentication, monitoring for suspicious deployment activities, and educating users to recognize phishing attempts. Review and restrict administrative privileges to the Deploy tool to minimize abuse potential.