> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ScreenConnect Client (Ab)used by Attackers - URL: https://f4n6.co.uk/security-feed/screenconnect-client-ab-used-by-attackers/ - Published: 2026-10-01T08:04:35.000Z - Updated: 2026-10-01T08:04:35.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary SANS ISC reported a phishing email linking to a legitimate, ConnectWise-signed ScreenConnect client preconfigured for an account operated by the attacker. The lure claimed receipt of a USD 5,745.65 EFT payment and directed the recipient to download `ScreenConnect.ClientSetup.exe`, which contained configuration for a ConnectWise-hosted cloud instance. No exploited vulnerability or CVE is identified, so no CVSS score, formal vulnerability severity or CISA Known Exploited Vulnerabilities state applies. EMEA financial services organisations face a conditional unauthorised remote-access risk, but the source provides no evidence of victim execution, successful connection, follow-on payloads, data access or financial loss. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The confirmed chain stops at phishing delivery and static analysis. The source does not establish compromise of a recipient endpoint. 1. A phishing email was sent from `contact@mejuri.com` with the subject `EFT Wire Transfer Paid Invoice Receipt`. It claimed that a USD 5,745.65 payment had been received and used a cancellation and refund pretext, including the telephone number `+1(332)638474823`. 2. The embedded link pointed to `https://thelittlecupandsaucer.com.au/ScreenConnect.ClientSetup.exe`. SANS ISC reported that the message passed the basic security controls applied to the recipient. 3. The downloaded file was a valid Windows PE containing a legitimate ScreenConnect client. It was signed by ConnectWise, LLC under the DigiCert G4 Code Signing CA1. 4. Authenticode inspection found that the calculated digest matched the signed digest. The file had no overlay, and no data had been appended to or injected into the certificate table. 5. Static configuration extraction identified the relay `instance-v2e3e2-relay.screenconnect.com`, TCP port `443`, ConnectWise-hosted cloud instance ID `v2e3e2`, and an RSA-2048 public key. The source published only the truncated key-blob SHA-256 value `16b1cec1…9b00ead7`. 6. The client was configured to call back to a test account described by SANS ISC as attacker-operated. The source does not report that the file was executed by a victim or that a callback occurred. No software vulnerability is part of the reported access method. There is no CVE, CVSS score or CISA KEV state to attach to the chain. The mechanism depends on social engineering and a correctly signed remote-management client configured for infrastructure outside the recipient's control. Controls that trust any ConnectWise-signed binary without checking its deployment source, instance ID or relay destination may therefore permit the client to run. The available evidence establishes no persistence beyond whatever installation behaviour the legitimate ScreenConnect client normally provides. It does not identify privilege escalation, credential access, lateral movement, secondary malware, data collection, exfiltration or destructive activity. Those actions must not be inferred from the remote-access capability alone. Related reporting describes separate phishing and ScreenConnect activity involving MSP360 installers, a fake Bank of America lure, modified ScreenConnect clients and a ScreenConnect file-transfer flaw. The supplied material does not connect those events, their infrastructure or their operators to this sample. This exact case is single-sourced to SANS ISC, and no named actor is identified. Attribution is unconfirmed. ## 4\. Mitigation & containment ### P1, within 24 hours - Quarantine messages matching the sender, subject, download URL, domain or telephone number in §5\. Preserve the original message and full headers before removal. - Block the reported download URL and `thelittlecupandsaucer.com.au` at email, DNS and web controls, subject to an internal ownership check. - Block outbound connections to `instance-v2e3e2-relay.screenconnect.com` on TCP port `443` where the instance is not authorised. Do not block the parent `screenconnect.com` domain without assessing operational dependencies. - Isolate endpoints on which `ScreenConnect.ClientSetup.exe` was downloaded or executed. Preserve the file, process telemetry, browser history, DNS records, proxy records and network connections before removing the unauthorised client. - Terminate any active session associated with instance ID `v2e3e2`. Remove the client through the organisation's normal software-removal process after evidence capture. - Treat the valid ConnectWise signature as publisher evidence only. Do not use it as the sole application-control decision for this file. ### P2, within 72 hours - Search retained email records for the exact subject, sender, URL and telephone number. Determine which recipients opened the message, followed the link or downloaded the executable. - Search endpoint and network telemetry for the filename, relay hostname, instance ID and outbound TCP `443` connection described in §5\. Extend the search to renamed executables where configuration inspection exposes the same relay or instance ID. - Inventory ScreenConnect clients across the estate and compare their relay hostnames and instance IDs with approved remote-support records. Investigate clients installed outside central software distribution. - Restrict RMM execution to approved packages, deployment channels and administrative groups. A publisher-only allow rule is insufficient for a legitimate client carrying an unauthorised configuration. - Review the retained email headers to establish whether `contact@mejuri.com` was spoofed or sent through infrastructure authorised for that domain. The source does not provide SPF, DKIM or DMARC results. ### P3, within 7 days - Require security approval for every RMM product and hosted instance used in the environment. Record the approved relay destinations, instance identifiers, package hashes and business owners. - Configure browser, email and endpoint controls to prevent direct execution of Internet-downloaded executables where business requirements permit. Provide a controlled exception process for approved software. - Alert on newly observed RMM software, installations from user-controlled directories, and connections to remote-management tenants absent from the approved inventory. - Review remote-support access procedures for financial operations endpoints and privileged administration systems. Remove unused RMM clients and access assignments. - Do not await a ScreenConnect patch for this event. The reported mechanism is misuse of a legitimate client, not exploitation of a disclosed ScreenConnect vulnerability. ## 5\. Indicators of compromise This IOC set is single-sourced; verify before enforcement. The relay belongs to ConnectWise-hosted infrastructure, so controls should target the exact hostname and instance rather than the parent service. The truncated RSA key-blob SHA-256 value is omitted because it is not a complete hash. | type | value | confidence | source | | ------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------------- | | email | contact@mejuri\[.\]com | High for the observed message, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | email subject | EFT Wire Transfer Paid Invoice Receipt | High for the observed message, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | phone | +1(332)638474823 | High for the observed message, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | url | hxxps://thelittlecupandsaucer\[.\]com\[.\]au/ScreenConnect.ClientSetup.exe | High for the observed message, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | domain | thelittlecupandsaucer\[.\]com\[.\]au | High for the observed download location, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | filename | ScreenConnect.ClientSetup.exe | High for the observed download, low specificity alone | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | domain | instance-v2e3e2-relay\[.\]screenconnect\[.\]com | High for the extracted configuration, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | | ScreenConnect instance ID | v2e3e2 | High for the extracted configuration, single source | [SANS ISC](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) | ```iocs email contact@mejuri[.]com email_subject EFT Wire Transfer Paid Invoice Receipt phone +1(332)638474823 url hxxps://thelittlecupandsaucer[.]com[.]au/ScreenConnect.ClientSetup.exe domain thelittlecupandsaucer[.]com[.]au filename ScreenConnect.ClientSetup.exe domain instance-v2e3e2-relay[.]screenconnect[.]com screenconnect_instance v2e3e2 ``` ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | A recipient follows the reported payment-themed link and downloads or executes ScreenConnect.ClientSetup.exe | Email gateway, browser download history, web proxy and EDR process telemetry | High for the reported delivery path, single source | | A ScreenConnect client configured for instance v2e3e2 attempts an outbound connection to instance-v2e3e2-relay.screenconnect.com on TCP port 443 | DNS, proxy, firewall and EDR network telemetry | High for the static configuration; execution and connection are unconfirmed | | A valid ConnectWise-signed client appears outside the organisation's approved software-distribution process | Application-control, code-signing and software-inventory telemetry | Medium because the signature is legitimate and is not malicious by itself | ## 6\. Detection The YARA rule should be applied to executable collections or quarantined downloads. Both strings are extracted configuration values, but repositories containing copied reporting may also match. ```yara rule ScreenConnect_Client_Config_Instance_v2e3e2 { meta: author = "Adverse Trace" date = "2026-10-01" reference = "https://isc.sans.edu/diary/rss/33388" description = "Detects the relay and instance values reported in the phishing-delivered ScreenConnect client" strings: $relay = "instance-v2e3e2-relay.screenconnect.com" ascii wide $instance = "v2e3e2" ascii wide condition: $relay and $instance } ``` The Sigma rule detects a connection attempt to the reported relay. Field mapping may be required for the client's network telemetry platform. ```yaml title: ScreenConnect Connection to Reported Instance v2e3e2 status: experimental description: Detects outbound traffic to the ScreenConnect relay configured in the reported phishing-delivered client references: - https://isc.sans.edu/diary/rss/33388 author: Adverse Trace date: 2026-10-01 logsource: category: network_connection detection: selection: DestinationHostname: instance-v2e3e2-relay.screenconnect.com DestinationPort: 443 condition: selection ``` ## 7\. Sources - SANS Internet Storm Center, “ScreenConnect Client (Ab)used by Attackers”, https://isc.sans.edu/diary/rss/33388, 2026-10-01. - The Hacker News, “Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks”, https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html, date not supplied in the provided material. - Huntress, “Bank of America Phishing Email Delivers ScreenConnect Malware”, https://www.huntress.com/blog/bank-spam-rmm, date not supplied in the provided material. - SecurityWeek, “Modified ScreenConnect Clients Used in Worm-Like Campaign”, https://www.securityweek.com/modified-screenconnect-clients-used-in-worm-like-campaign/, date not supplied in the provided material. - Help Net Security, “Attackers spread malware through ScreenConnect file transfers”, https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/, 2026-09-07. ## 8\. Adverse Trace position Adverse Trace does not assign a CVSS-based severity because the evidence identifies no vulnerability, CVE, CVSS score or CISA KEV state. We assess this as a credible phishing and unauthorised remote-access attempt, but client impact remains conditional because the source reports no victim execution, successful callback, lateral movement, data access or loss. No named actor is identified, and attribution is unconfirmed. The exact campaign, IOC set and attacker-operated-instance claim are single-sourced; verify before enforcement. We will monitor the reported infrastructure, vendor reporting and CISA records for corroboration, and will update clients if execution evidence, further infrastructure, a vulnerability mapping or downstream activity is identified. --- [Read the original source →](https://isc.sans.edu/diary/rss/33388?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*