The Tool You Trust —
ScreenConnect RMM Abuse and the Email Delivery Gap

Executive Summary

I run a private threat intelligence pipeline that ingests public feeds. During a routine infrastructure review this week, URLhaus data surfaced a pattern that stopped me: multiple IPs on the same /24 subnet serving ConnectWise ScreenConnect installers, two cloud-hosted *.screenconnect.com C2 instances still live as of August 22, 2026, and a separate Amadey dropper infrastructure active on the same day. I ran the queries. Then I started digging.

What I found is not a new vulnerability. It is something more persistent and more difficult to stop: the systematic weaponization of trusted remote access software as a post-phishing persistence mechanism. ScreenConnect is legitimate IT software, signed by ConnectWise, trusted by endpoint security tools, and widely deployed across enterprise environments. Attackers are not exploiting a flaw in ScreenConnect — they are exploiting the trust that organizations have placed in it.

Over 1,300 indicators of compromise mimicking ScreenConnect download paths and binaries have emerged since mid-April 2025. Multiple distinct campaigns — SMOKE#SCREEN, SILENTCONNECT, and a Microsoft-documented phishing operation using AI-generated company names on Extended Validation certificates — all converge on the same final payload: a ScreenConnect client connecting to attacker-controlled infrastructure, giving the operator persistent, trusted remote access to the victim machine.

What the Data Showed — Live Infrastructure, August 2026

The URLhaus public feed — a community-maintained registry of active malware distribution URLs — surfaced the following on August 21-22, 2026. All of this data comes from the public API; it is available to any researcher who queries it.

Three patterns stand out. First, the 94.154.32.0/24 subnet is coordinated — multiple IPs activated within hours of each other, all serving the same two file paths. This is not coincidence. It is infrastructure provisioned for a campaign.

Second, the *.screenconnect.com subdomains — nimblenumbers and paretandassociates — are attacker-registered ConnectWise cloud instances. ConnectWise allows anyone to create a free cloud-hosted ScreenConnect deployment at a *.screenconnect.com subdomain. Attackers use this to host their C2 on a trusted domain that passes every reputation check. An email security tool scanning outbound connections would see traffic to screenconnect.com — a legitimate enterprise software platform — and pass it.

Third, the Amadey infrastructure at 91.92.242.236 is consistent with a known dropper-to-RMM chain. Amadey is delivered via phishing email, establishes initial access, and then downloads secondary payloads — in many documented cases, ScreenConnect installers. The two infrastructure clusters may be part of the same campaign.

The Email Delivery Layer — Three Documented Vectors

URLhaus captures the download infrastructure — step three in the attack chain. The phishing email is step one. This section documents the three email delivery vectors confirmed in 2026 ScreenConnect campaigns, all of which land in the inbox before the installer ever runs.

Vector 1 — Workplace Lure Phishing with Signed Malware

In February 2026, Microsoft Defender Experts documented multiple phishing campaigns using workplace meeting lures and PDF attachments to deliver signed malware. The executables were digitally signed using an Extended Validation certificate issued to "TrustConnect Software PTY LTD" — a company name that reads as AI-generated: plausible, professional, forgettable, and entirely fictional. Extended Validation certificates require identity verification, but attackers have found ways to register shell entities and obtain legitimate EV certificates for them. The signature passes every automated check. The only defense is the human reading the email — or the email security tool that intercepts it before that human sees it.

Vector 2 — ClickFix Clipboard Hijack

The ClickFix social engineering technique — documented in my ClickFix field note and the subject of a merged Sublime Security detection rule (PR #4921, merged August 26, 2026) — is a confirmed delivery mechanism for ScreenConnect installers. The attack delivers a phishing email with a fake CAPTCHA or verification prompt, instructs the victim to copy and paste a command into their terminal, and the pasted command downloads a ScreenConnect installer from infrastructure like the 94.154.32.0/24 subnet observed this week. The victim does not realize they have installed remote access software. From the attacker's perspective, the victim performed the installation themselves.

Vector 3 — SMOKE#SCREEN: Fake Software Update Lures

Securonix documented SMOKE#SCREEN, active since early 2026, which uses fake Adobe and Zoom software update lures, business document review prompts, and system maintenance notifications to trick employees into downloading ScreenConnect. The campaign uses VBScript droppers, batch file loaders, and compiled .NET executables — a multi-stage chain that culminates in a ScreenConnect agent beaconing to attacker-controlled relay servers. The email that starts this chain looks like a routine software update notification. Recipients who have been trained to "trust software from known vendors" are the intended targets — because the lure impersonates exactly those vendors.

Why Email Is the Right Detection Layer

Every campaign documented in this analysis produces the same outcome: a signed ScreenConnect client running on the victim machine and connecting to attacker infrastructure. At that point, from the perspective of endpoint security:

• The process is digitally signed by ConnectWise — a legitimate, trusted vendor
• The network traffic goes to *.screenconnect.com or a registered cloud instance — a legitimate domain
• The behavior (remote access, file transfer, screen sharing) matches legitimate IT support activity
• No malware signature matches — because it is not malware, it is legitimate software being misused

Endpoint detection and response tools are not designed to block legitimate remote access software. Network monitoring tools will not flag traffic to a trusted vendor domain. Identity and access management tools have no visibility into what a trusted IT support session is doing. By the time ScreenConnect is installed and connected, every downstream technical control has been bypassed — not defeated, just made irrelevant.

The email is the last reliable interception point. The phishing email, the ClickFix lure, the fake software update notification — all of these reach the inbox before a single line of malicious code runs on the endpoint. Catching the delivery mechanism at the email layer is not just one detection option among many. For this attack class, it is the only technical control with a realistic chance of stopping the attack before it succeeds.

The Current Coverage Gap

Sublime Security's existing link_screenconnect.yml rule detects emails containing links to ScreenConnect installers where the embedded relay domain does not match the sender or organization — a sophisticated check that catches many campaigns. The gap revealed by this week's URLhaus data is the *.screenconnect.com cloud C2 variant. When an attacker registers their own ConnectWise cloud instance at nimblenumbers.screenconnect.com, the relay domain IS screenconnect.com — and it matches. The existing rule does not fire. A phishing email linking to a *.screenconnect.com subdomain, from an unsolicited sender, is currently undetected. A complementary rule targeting this pattern is in development.

We opened Pandora's box. AI capabilities are accelerating every attack vector simultaneously — better phishing prose, AI-generated company names for code signing certificates, cover commits that fool code reviewers, chatbot poisoning for software distribution. Defense cannot match that pace everywhere. What defense can do is close the gaps at the layers that still have reliable signal, before the payload ever runs. Email is that layer. These rules are that signal.

IOCs sourced from URLhaus public API (abuse.ch), queried August 21-22, 2026. Campaign context sourced from: Microsoft Security Blog (February 2026, May 2026), Securonix Threat Research (SMOKE#SCREEN, August 2026), Elastic Security Labs (SILENTCONNECT, March 2026), Maltiverse threat intelligence advisory (April 2025), Broadcom/Symantec protection bulletin (July 2025), and Infosecurity Magazine (August 2025). All domains and IPs defanged for publication. The *.screenconnect.com detection gap and fast-follow PR represent the author's original analytical contribution. This analysis represents independent research produced as a contribution to the security community. References: ClickFix Field Note · Glassworm Analysis