Malware

ConnectWise Control

ConnectWise Control (formerly ScreenConnect) is a legitimate remote access and remote monitoring tool that has been observed abused in malicious operations. In the provided reporting, a trojanized payload named WinDesk.Client.exe was delivered through brand-impersonation phishing and subscription-cancellation scam infrastructure spoofing organizations such as PayPal, Amazon, Microsoft, Geek Squad, and Norton. After execution, the observed process chain involved dfsvc.exe launching ScreenConnect.WindowsClient.exe and screenconnect.clientservice.exe. The final dropped service attempted to connect to 104.168.5[.]29, which resolved to firsto[.]cc. The activity was associated with a broader phishing ecosystem including domains such as paypalsec[.]us, help01[.]us, firsto[.]top, firsto[.]cc, mslxt[.]xyz, ncareback[.]xyz, backup02[.]xyz, gkscare[.]com, geeksupportcare[.]com, xpchelps[.]us, support2norton[.]us, and xpchelp[.]us, as well as payload download domains win01[.]xyz through win04[.]xyz. The likely infection vector in that reporting was email-based social engineering followed by phone interaction to convince victims to enter a code and download the payload. Separately, the content states that Scattered Spider members deploy commercial RMM software including ConnectWise Control, along with AnyDesk and LogMeIn, to establish persistence on compromised networks. High-confidence indicators directly tied to the observed ConnectWise Control abuse include ScreenConnect.WindowsClient.exe, screenconnect.clientservice.exe, 104.168.5[.]29, and firsto[.]cc.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques

T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

T1133External Remote ServicesEvidence2

Initial access was varied: Social engineering using phone calls and text messages to impersonate IT personnel, and either directing victims to a credential harvesting site or directing victims to run commercial Remote Monitoring and Management (RMM) tools.

T1566PhishingEvidence1

Phishing Invitations : Attackers send deceptive emails containing malicious links disguised as routine business communications, such as fake Zoom or Microsoft Teams calendar invites.

T1566.002Spearphishing LinkEvidence1

Clicking the link triggers a background download of a pre-configured ConnectWise client.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

Via the ConnectWise Control center it's possible to type a command, hit the 'Run Command' button, after which the command is executed. The commands that are allowed to be used are the commands that are generally supported by the Windows Command Prompt.

T1059.001PowerShellEvidence1

However, manually-executed shell commands are launched from ScreenConnect.ClientService.exe as command (.cmd) scripts, whereas tasks like process listing and termination are executed via Powershell (.ps1) scripts.

T1059.003Windows Command ShellEvidence1

C:\Program Files (x86)\ScreenConnect Client (<hex string>)\ScreenConnect.ClientService.exe --> "cmd.exe" /c "C:\Windows\TEMP\ScreenConnect\<version>\<uuid>run.cmd" --> <executed shell command>

T1204User ExecutionEvidence1

Once the program is installed or a connection code is provided, the scammer gains administrative access to your device.

Persistence

2 techniques

T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

T1133External Remote ServicesEvidence2

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

Stealth

2 techniques

T1070Indicator RemovalEvidence1

If we can modify the application in such a way that EventLog.WriteEntry() is no longer ever executed, we can prevent the generation of event logs... This ensures that ScreenConnect can no longer generate any events and will create less evidence.

T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

They can view your screen, track your keystrokes, steal stored passwords, and download malware.

Lateral Movement

1 technique

T1021Remote ServicesEvidence2

ConnectWise Control (among others) offers functionality to remotely: Execute arbitrary commands; Terminate processes; Uninstall software; View event logs; Start / Stop services; Install Windows updates. Additionally, ConnectWise Control allows an operator to take control of a machine's desktop session.

Collection

1 technique

T1056.001KeyloggingEvidence1

They can view your screen, track your keystrokes, steal stored passwords, and download malware.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

During a recent incident response case, the File Transfer functionality was among others used to upload MimiKatz to a compromised system, as well as to upload other tools like Advanced IP Scanner and the actual ransomware.

T1219Remote Access ToolsEvidence4

“persistent ScreenConnect agent = full remote access for the attacker” and “This is MITRE T1219 (Remote Access Software).”

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

RMM has become a more prominent vector for initial access, persistence, and data exfiltration

Other

1 technique

T1562Impair DefensesEvidence1

ScreenConnect events are generated by the application itself, meaning that a determined attacker can prevent any logs from being created... patch the bytecode of ScreenConnect.Core.dll ... and overwrite the call to EventLog.WriteEntry().

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

silentpush blogNews

Oct 17, 2022

Silent Push uncovers a large trojan operation featuring Amazon, Microsoft, Geek Squad, McAfee, Norton, and Paypal domains. - Silent Push Threat Intelligence

Legitimate remote access software abused in this campaign: installed/launched via the WinDesk.Client.exe infection chain, culminating in a client service that attempts to establish a connection to attacker infrastructure (104.168.5[.]29 / firsto[.]cc), enabling remote access and potential data capture (the content notes keystroke recording potential).

mitre attackNews

Jan 25, 2026

Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, Group G1015 | MITRE ATT&CK®

Legitimate remote access/RMM tool (ScreenConnect) abused for persistence and remote administration of victim hosts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ConnectWise Control