Hackers abuse Faronics Deploy admin tool to install ScreenConnect
Summary
Attackers are exploiting the Faronics Deploy endpoint management tool to gain administrative access to victim computers. They are then using this access to install the ScreenConnect remote support software, which can be used for further malicious activities.
IFF Assessment
FOE
This article details a new method for attackers to gain unauthorized administrative access to systems, which is detrimental to defenders.
Defender Context
Defenders should be aware of this technique, as it leverages a legitimate administrative tool for malicious purposes. Monitoring for unusual activity related to Faronics Deploy and the installation of remote access tools like ScreenConnect is crucial.