CampaignPublished 12 Feb 2026

ScreenConnect Attack: SmartScreen Bypass and RMM Abuse

Source AlienVault OTX General

Description

An attack campaign targeting organizations in the US, Canada, UK, and Northern Ireland exploits ConnectWise ScreenConnect vulnerabilities. The attack chain begins with a spoofed email containing a malicious .cmd attachment, which executes silently, escalates privileges, disables Windows SmartScreen, and removes the Mark-of-the-Web. It then installs a legitimate Remote Monitoring and Management tool, ScreenConnect, which is abused as a Remote Access Trojan for persistent command-and-control access. The campaign focuses on sectors with high-value data, including government, healthcare, and logistics. The attackers use various techniques to evade detection, including UAC bypass, registry modification, and silent MSI installation. The ScreenConnect client used has a revoked certificate, highlighting the importance of blocking vulnerable software versions and enforcing strict RMM allowlists.

Impact

For European organizations, particularly those in government, healthcare, and logistics sectors, this threat poses significant risks. The abuse of a legitimate RMM tool like ScreenConnect allows attackers to gain persistent, stealthy remote access, potentially leading to data exfiltration, espionage, or ransomware deployment. Disabling SmartScreen and bypassing UAC reduces the effectiveness of built-in Windows security controls, increasing the likelihood of successful compromise. The stealthy installation and execution methods hinder detection by traditional endpoint security solutions. Given the targeting of UK and Northern Ireland, European organizations with similar profiles or using ScreenConnect are at risk. The impact includes potential loss of confidentiality of sensitive data, disruption of critical services, and reputational damage. The campaign’s focus on high-value sectors aligns with strategic interests in Europe, where healthcare and government data protection are heavily regulated. The use of revoked certificates and social engineering complicates incident response and forensic investigations. Overall, the threat could lead to significant operational and financial consequences if not mitigated effectively.

Defensive guidance

1. Enforce strict allowlisting policies for Remote Monitoring and Management (RMM) tools, permitting only verified and up-to-date versions of ScreenConnect and similar software. 2. Implement advanced email filtering and phishing detection mechanisms to block spoofed emails and malicious attachments, especially .cmd files. 3. Monitor and restrict the use of scripts and MSI installers that execute silently or modify system settings. 4. Enable and enforce Windows SmartScreen and UAC policies without exceptions; investigate any attempts to disable these features. 5. Regularly audit installed software certificates and block execution of binaries signed with revoked or untrusted certificates. 6. Employ endpoint detection and response (EDR) solutions capable of detecting privilege escalation, registry modifications, and unusual RMM tool behaviors. 7. Conduct user awareness training focused on phishing and social engineering tactics used to deliver malicious attachments. 8. Maintain comprehensive logging and monitoring of RMM tool usage and network connections to detect anomalous command-and-control activity. 9. Segment networks to limit lateral movement from compromised endpoints, especially in critical sectors. 10. Collaborate with threat intelligence providers to update detection signatures and indicators of compromise (IOCs) such as the provided hashes and domains.

Indicators of compromise

Domains 1

dof-connect.top

Hashes 7

1db8b9fa0bdcbfaab807f715c288c19a
0fa008dfd45f39879412275d1a4c178cf7affae2
46fce36f4901d6acf19aaaa9cbd1a14df6d6aa85
48a5034e75b526e1a9371b4e728b02fb81d2c7c1
b46c4e4694783311e2c612ed7f0ca67a88e1e352
fde73710ce063bbf1e377c02a1a8615cf4da1c08
b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Feb 2026, 22:19 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 7

Community reviews

Related threats