Phishing Campaigns Abuse MSP360 and ScreenConnect for Persistent Access

Sep 29, 2026 · Original article ↗

Summary

Microsoft reports phishing campaigns that delivered a disguised MSP360 installer, which installed ScreenConnect as a second remote-access channel. Attackers used the tools for persistence, credential access, information collection, and follow-on activity.

Key points

Observed in July 2026, the campaigns used meeting, PDF, software-update, and other business-themed phishing lures to distribute legitimate MSP360 RMM software under deceptive filenames.
After successful UAC elevation, MSP360 installed persistent Windows services and registry autorun entries, and added a Windows Firewall rule.
The MSP360 agent used PowerShell to download and silently install a ConnectWise ScreenConnect client, giving attackers a redundant remote-access channel.
Attackers used ScreenConnect to transfer and run utilities associated with credential access, information collection, and reduced defender visibility.
Microsoft also observed Faronics Deploy used to install ScreenConnect in separate activity; it has not attributed the campaigns to a named actor.
Microsoft provides Defender detections, hunting queries, indicators, and guidance to govern approved RMM tools, block unapproved software, and investigate unauthorized installations.

Article Details

Attack Vectors: Phishing emails and social-engineering lures directed victims to landing pages and download locations hosting a legitimate, digitally signed MSP360 RMM installer under deceptive filenames.
After successful UAC elevation, the MSP360 installer established services and registry autorun entries, then used its agent to invoke PowerShell, download ClientSetup.msi, and silently install ConnectWise ScreenConnect.
ScreenConnect provided a secondary remote-access channel used to transfer and execute additional utilities on compromised endpoints; Microsoft also observed FaronicsDeployAgent.exe used to download and install ScreenConnect.
Follow-on activity included credential-access operations, local information collection, and deployment of utilities through ScreenConnect’s RunFile functionality.
Defensive Notes: Govern approved RMM tools and enforce multifactor authentication where supported.
Use Application Control for Windows or AppLocker publisher rules to block unapproved IT management software; Microsoft Defender for Endpoint can also block specific signed applications by certificate.
Search for unapproved RMM installations and reset passwords for accounts used to install RMM services; investigate further if a system-level account was used.
Enable cloud-delivered protection in Microsoft Defender Antivirus or an equivalent endpoint protection product.
Enable the recommended attack surface reduction rule and block process creation originating from PsExec and WMI commands, while considering the noted compatibility issues on some server systems.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`adsaw[.]cfd`	Domain contacted by ScreenConnect clients in observed malicious sessions.
DOMAIN	`adswre[.]cfd`	Domain contacted by ScreenConnect clients in observed malicious sessions.
DOMAIN	`bunstar[.]harej[.]si`	Domain contacted by ScreenConnect clients in observed malicious sessions.
DOMAIN	`ojsuyw[.]niyari[.]org`	Domain contacted by ScreenConnect clients in observed malicious sessions.
DOMAIN	`sdfghj[.]rd-team[.]ru`	Domain contacted by ScreenConnect clients in observed malicious sessions.
DOMAIN	`swedcorry[.]stefneyv[.]com`	Domain contacted by ScreenConnect clients in observed malicious sessions.
DOMAIN	`trews[.]cfd`	Domain contacted by ScreenConnect clients in observed malicious sessions.
SHA1	`f34330d4c6e0aa978dc3af40360c14b31ad51127`	Hash of the MSP360 RMM installer observed in the campaign’s deceptive payload distribution.
SHA256	`02f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`06ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426b`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc`	Legitimate MSP360 RMM v2.5.0.67 installer observed distributed under deceptive filenames during the campaign.
SHA256	`19035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`1a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`3ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`40f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`4188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26`	Hash of a legitimate MSP360 RMM Agent Service observed during the campaign.
SHA256	`499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`5bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971b`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`67c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`6a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e`	Listed as a campaign-associated MSP360 RMM installer or agent artifact.
SHA256	`6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`77fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27a`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3`	Listed as a campaign-associated MSP360 RMM installer or agent artifact.
SHA256	`a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5b`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6c`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`c2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126db`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`d3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53ef`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`d49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdc`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`dd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.
SHA256	`f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97`	Listed as a campaign-associated MSP360 RMM installer or agent artifact.
SHA256	`fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2`	Hash of a utility transferred or executed through ScreenConnect during post-compromise activity.

MITRE ATT&CK

T1005 · Data from Local SystemUtilities delivered through ScreenConnect were used in post-compromise activity to collect information from victim devices.T1036 · MasqueradingThe actor distributed legitimate MSP360 software under filenames resembling meetings, invitations, PDFs, and business documents.T1036.005 · Match Legitimate Resource Name or LocationFollow-on utilities used filenames resembling Windows, Microsoft Defender, security, and Phone Link applications.T1059.001 · PowerShellThe MSP360 RMM.Agent.exe service launched PowerShell to download and install ConnectWise ScreenConnect.T1059.003 · Windows Command ShellThe installation workflows used cmd.exe for logging, prerequisite checks, file management, and installation tasks.T1071.001 · Web ProtocolsPowerShell and ScreenConnect communicated with actor-controlled infrastructure over HTTP/HTTPS.T1082 · System Information DiscoveryThe installer enumerated installed .NET runtimes using dotnet –list-runtimes.T1102 · Web ServiceCloud-hosted web services were used in the campaign’s delivery and command-and-control infrastructure.T1105 · Ingress Tool TransferMSP360 downloaded ScreenConnect, which was then used to transfer and execute additional tooling on compromised endpoints.T1112 · Modify RegistryMSP360 and ScreenConnect modified registry locations associated with services, persistence, credential-provider components, protocol handlers, and uninstall entries.T1204 · User ExecutionVictims downloaded and executed a masqueraded MSP360 installer distributed under deceptive filenames.T1218.007 · MsiexecThe downloaded ClientSetup.msi package was installed silently using msiexec.exe with the /qn switch.T1219 · Remote Access ToolsThe actor abused MSP360 RMM and ConnectWise ScreenConnect to maintain remote access to victim systems.T1543.003 · Windows ServiceMSP360 and ScreenConnect were installed as Windows services to establish persistent access.T1547.001 · Registry Run Keys / Startup FolderMSP360 created registry Run entries to launch tray application components automatically at user logon.T1566.002 · Spearphishing LinkPhishing emails with meeting, invitation, RSVP, PDF, Zoom, Google Meet, and Adobe themes linked victims to malicious payload download locations.T1573 · Encrypted ChannelPayload retrieval and remote-access communications occurred over encrypted network channels.T1583.001 · DomainsDomains were used to host phishing landing pages, payload delivery infrastructure, and ScreenConnect services associated with the campaign.T1583.006 · Web ServicesThe actor leveraged Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase for payload distribution.

Vendors

AmazonUpon user interaction, victims were redirected to download locations hosted on both attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.CloudflareUpon user interaction, victims were redirected to download locations hosted on both attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.ConnectWiseMicrosoft observed the MSP360 deployment being used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel that provided redundant access to compromised systems.DropboxUpon user interaction, victims were redirected to download locations hosted on both attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.Faronics GitLabUpon user interaction, victims were redirected to download locations hosted on both attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.MicrosoftIn July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through MSP360phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software SupabaseUpon user interaction, victims were redirected to download locations hosted on both attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.

Products

Application Control for WindowsRestrict unauthorized software: Use Application Control for Windows to create policies to block unapproved IT management tools.AppLockerAppLocker’s publisher rule condition is available for files that are digitally signed, which can enable organizations to block non-approved RMM instances that include publisher information.ConnectWise ScreenConnectMicrosoft observed the MSP360 deployment being used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel that provided redundant access to compromised systems.FaronicsDeployAgent.exeMicrosoft also observed separate activity during July in which FaronicsDeployAgent.exe, a legitimate deployment and remote access application, was used in a similar manner to MSP360 RMM.Microsoft Defender AntivirusStrengthen endpoint protection: Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques.Microsoft Defender for EndpointMicrosoft Defender for Endpoint detects suspicious and uncommon remote-management activity, while the hunting queries and mitigations in this post can help organizations identify and restrict unapproved RMM use.Microsoft Defender XDRMicrosoft Defender XDR detections MSP360 RMMThe observed multi-stage intrusion chain began when phishing lures delivered a legitimate, digitally signed MSP360 RMM v2.5.0.67 installer under deceptive filenames.