MalwarePublished 31 Dec 2025Updated 2 Jan 2026

Rogue ScreenConnect: Common Social Engineering Tactics Seen in 2025

Source AlienVault OTX General

Description

In 2025, there was a significant increase in rogue ScreenConnect installations, part of a broader trend of threat actors abusing remote monitoring and management tools (RMMs). These tools were used to gain access, blend in, move laterally, and maintain persistence in target systems. Attackers employed various social engineering tactics to trick employees into downloading malicious RMMs. Common lures included fake Social Security statements, invitations, and financial documents. The Huntress Security Operations Center identified recurring patterns in lures, domains, and file hashes associated with these attacks. Some campaigns showed signs of targeting specific industries, such as accounting firms. The article provides detailed examples of attack patterns, top malicious domains, and file hashes observed throughout the year.

Impact

For European organizations, this threat poses a substantial risk to confidentiality, integrity, and availability of critical systems and data. The use of rogue ScreenConnect installations enables attackers to gain persistent remote access, facilitating data exfiltration, unauthorized modifications, and potential disruption of services. Industries such as accounting and finance are especially vulnerable due to the sensitive nature of their data and the frequent use of RMM tools for operational efficiency. The social engineering component increases the likelihood of initial compromise, as employees may be deceived into installing malicious software. Once inside, attackers can move laterally, potentially compromising multiple systems and escalating privileges. This can lead to significant financial losses, regulatory penalties under GDPR for data breaches, and reputational damage. The stealthy nature of these attacks complicates detection and response, increasing dwell time and the potential scope of impact. European organizations with less mature security awareness programs or insufficient controls around RMM tool deployment and monitoring are at heightened risk.

Defensive guidance

To effectively mitigate this threat, European organizations should implement a multi-layered approach beyond generic advice: 1) Conduct targeted security awareness training focusing on recognizing social engineering lures related to financial and governmental documents, emphasizing skepticism of unsolicited attachments and links. 2) Enforce strict application whitelisting and control policies to prevent unauthorized installation of RMM tools, including blocking known malicious domains and hashes identified in threat intelligence feeds. 3) Implement robust endpoint detection and response (EDR) solutions capable of identifying anomalous RMM activity and lateral movement behaviors. 4) Apply network segmentation to isolate critical systems and limit the spread of compromise if rogue RMM access occurs. 5) Regularly audit and monitor legitimate RMM tool usage, ensuring only authorized personnel have access and that remote sessions are logged and reviewed. 6) Deploy multi-factor authentication (MFA) for all remote access services to reduce the risk of credential abuse. 7) Collaborate with threat intelligence providers to stay updated on emerging lures, domains, and file hashes associated with these campaigns. 8) Establish incident response playbooks specifically addressing RMM abuse scenarios to enable rapid containment and remediation.

Indicators of compromise

Domains 10

advancedaiinfrastructures.com
lory473.top
slplegalfinance.com
0bd0.adrsxpjm0rga0n.de
administrator.pulseriseglobal.com
pv-sq.innocreed.com
rok628.mxhelp.top
sans.infosedi.de
subjent25.zapto.org
yoc736.ikhelp.top

Hashes 20

0558992098f614dc5efb8ed3af31bc44
07db8dc15b292898f4242d642908e2b7
512f3f14220f90d9c2abcbb4928d2c2e
576267934992cf26c9e73daf3a0f1b71673a29e4
d0458900b1c3548469839934fd27381f72998bd6
f204b435ec284c933de1bf5f88ef850a380d6d57
1af6e82e53622e4404668aa00e2772aae2515110a4440721c2ece040011fe981
44b6b1de9a618c97788631bc89372435a6ea0357e50497152a67219dea400209
7fdfe8b34ad911fa007d9f2c8b2cb99cea0ac760d23643850a72e75cf8aa62c3
82cb1fee5f4a7420d378efe0c4a9fc52d547208cb04c87d17c37b714778c9935

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Jan 2026, 11:14 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 10

Hashes 20

Community reviews

Related threats