# When Your IT Management Tool Becomes the Attacker's Favorite Backdoor
There's no malware in this attack. That's what makes it dangerous.
Threat actors are running phishing campaigns that abuse Faronics Deploy — a legitimate endpoint management platform used by schools and enterprises to remotely manage fleets of computers — to install ScreenConnect on victim machines. The payload isn't a dropper or a RAT. It's software your IT team might already have approved. That's the whole game.
## The Setup: Trusted Infrastructure as Cover
Faronics Deploy markets itself on the same qualities attackers need: broad remote access to endpoints, software deployment capabilities, and a reputation that gets it past security controls. Schools, in particular, rely on it for managing student and staff machines across distributed campuses — exactly the kind of sprawling, under-resourced environment where a new remote session might go unnoticed for days.
The attack begins where most do: phishing. Victims receive a lure that convinces them to interact with something that triggers Faronics Deploy. From there, the attackers have what every ransomware operator and espionage crew dreams about — legitimate admin-level access to the endpoint, delivered through a platform the organization already trusts.
The ScreenConnect installation is the persistence move. ConnectWise ScreenConnect is a mature remote support tool with signed binaries, legitimate certificate chains, and genuine business use. Deploying it via Faronics means the installation looks exactly like an IT department pushing remote access software — because mechanically, it is.
## Why ScreenConnect Is the Real Target
ScreenConnect has been a preferred post-compromise tool for years. CISA and partners called this out explicitly in a 2023 joint advisory warning that threat actors were systematically abusing remote monitoring and management (RMM) software — ScreenConnect included — to maintain persistent access to victim networks without triggering endpoint detection tools.
The logic is cold and rational. A custom implant has indicators. A novel backdoor might get flagged. ScreenConnect has been on corporate allowlists for a decade. Once installed, the attacker has a reliable, encrypted, GUI-based remote access channel that blends seamlessly into legitimate IT traffic. Security teams hunting for C2 beacons and shellcode won't find either.
Earlier in 2024, ScreenConnect itself made headlines for a different reason: CVE-2024-1709, a critical authentication bypass that ransomware groups exploited within days of public disclosure. The irony of the current campaign is that attackers no longer need to exploit ScreenConnect — they just need to install it.
## The Faronics Angle Most Coverage Is Missing
Most reporting on RMM abuse focuses on the obvious targets: AnyDesk, TeamViewer, Atera, NinjaRMM. Faronics Deploy is a less-discussed platform, which may be exactly why it's attractive. Defenders who have written detection rules for the usual suspects may have no coverage for Faronics-originated remote sessions.
There's also a deployment context worth examining. Faronics has historically been popular in K-12 education and government settings. These are environments with:
If the attackers targeting this campaign are choosing victims based on Faronics Deploy installations specifically, that narrows the target pool but also concentrates the blast radius on sectors that are already chronically underfunded for security response.
## What Defenders Actually Need to Do
The uncomfortable reality is that no EDR rule blocks "install legitimate software via legitimate admin tool." The detection gap here is architectural, not technical.
A few concrete responses that matter:
Lock down what Faronics Deploy can install. Most endpoint management platforms support application allowlisting or deployment policies. If remote software deployment is locked to an approved list, ScreenConnect can't be pushed unless it's already on it. Review those policies now.
Alert on new RMM tool installations, regardless of source. If ScreenConnect, AnyDesk, TeamViewer, or any other remote access tool appears on an endpoint and IT didn't explicitly push it through a change management ticket, that's an incident. Build the detection. This should be a mandatory alert, not a recommendation.
Audit Faronics Deploy access. Who has admin credentials to your Faronics instance? Is MFA enforced? Are there rogue sessions? The phishing lure gets an attacker in the door, but the door is Faronics — and Faronics has logs.
Network-level: watch for new ScreenConnect relay traffic. ScreenConnect communicates through ConnectWise's relay infrastructure. If your organization doesn't use ScreenConnect, unexpected outbound connections to those relay servers are a high-confidence indicator. If you do use it, unexpected new instance IDs connecting are worth examining.
---
## HackWire Analysis
This attack is a textbook example of what threat researchers call "living off trusted tools" — a category that's quietly becoming the dominant evasion strategy for everything from commodity ransomware groups to state-sponsored operators. The trend line is clear and it's accelerating.
In 2021, the Conti ransomware group's leaked playbooks showed explicit instructions for deploying AnyDesk and ScreenConnect as persistence mechanisms. Since then, the DFIR community has documented this technique across dozens of ransomware families and multiple APT clusters. CISA's 2023 RMM advisory acknowledged the problem but focused on awareness rather than specific technical controls — guidance that many organizations have not operationalized.
What's different about the Faronics Deploy vector is the layering. Previous campaigns typically phished for credentials to an existing RMM console, or socially engineered victims into installing ScreenConnect directly. This campaign uses one legitimate admin platform to install another. The attack surface detection has to work at is now two tools deep, and most organizations' visibility stops at one.
The education sector targeting hypothesis deserves more scrutiny. K-12 institutions were among the most heavily ransomware-hit sectors in 2022 and 2023. If Faronics Deploy's installed base overlaps significantly with that victim profile, defenders in those environments should treat this as a high-priority threat — not background noise. The CISA K-12 cybersecurity resources and MS-ISAC's no-cost services exist precisely for this gap, and too few districts use them.
For security teams in any sector: the lesson is that your approved vendor list is now part of your attack surface. Threat modeling needs to account for what an attacker can do *with* your tooling, not just *to* it.
— HackWire Editorial
---
## Related Coverage