From a phishing link to a stranger on your screen

ConnectWise ScreenConnect is remote support software. IT providers use it every day to fix computers from a distance. Attackers use it too. They run their own copy, then trick someone at a business into installing it. Once it's installed, they can see the screen and control the computer whenever it's running.

This write-up comes from incident response work we did for a small business. We've left out who it was, when and where it happened, and the technical details of the case. The pattern itself is common, and it's worth knowing.

How it happens

1. The email. It looks routine: a shared document, an invoice, a statement, an invitation or a request to sign something. It often comes from a real account at a company you know, because that account was taken over first. That helps it get past spam filters, and past people.
2. The link. It opens a page that says you need a viewer or a secure reader to open the file. The button downloads an installer.
3. The install. The installer is a genuine, signed copy of ScreenConnect, set up to connect to the attacker's server instead of a real IT provider's. Antivirus that looks for known bad software often lets it through, because the software itself is legitimate. If the person is an administrator on their computer, it installs in seconds. At most they see one prompt asking to allow changes, and they click Yes.
4. The access. The tool runs in the background and starts with the computer. The attacker can watch the screen, move the mouse, copy files and run commands. Many wait until after hours, when nobody is at the desk.
5. The damage. With the computer under their control, attackers read email and documents, collect passwords saved in the browser, sign in to banking and accounting, change payment details on invoices, and send more phishing from the business's own email. Many add a second remote tool, so removing the first one doesn't lock them out.

Why it works

• It's real software. Security tools trust it, and so do people.
• Someone at the business installed it. Nothing had to break in.
• At most small businesses, employees are administrators on their own computers.
• Nobody is watching the computers at night.

How to spot it

Signs anyone can check

• A remote support program you don't remember installing, in your list of installed apps.
• The mouse moving or windows opening on their own, or a computer that wakes up at night.
• A remote session banner, or a new icon near the clock.
• Sign-in alerts or password reset emails you didn't ask for.
• Customers or vendors asking about emails or payment changes you didn't send.

For whoever runs your IT

• Any remote access tool that isn't on your approved list. If your business doesn't use ScreenConnect, any copy of it is suspect. If it does, check that every copy connects to your own server.
• New services set to start automatically, especially ones installed from a user's Downloads folder.
• Remote tools that appear outside your normal deployment process, or on the same day someone clicked a link in an email.
• Outbound connections to remote support servers you don't operate.

What stops it

No single product stops every version of this. Three layers together close it off.

1. Admin By Request: no everyday admin rights

Admin By Request takes administrator rights away from everyday accounts. When someone needs to install something, they ask, someone approves it or not, and every request is logged. A viewer for an invoice doesn't get approved, so the installer stops there.

Some remote tools can run without admin rights. This layer narrows the attack. It can't close it alone.

2. Huntress: someone watching around the clock

Huntress runs on every protected computer and watches for what a rogue install leaves behind: a remote access tool that appeared out of nowhere, a new service set to survive a restart, a second tool added as a backup. Their analysts review what it finds around the clock and can cut the computer off from the network within minutes. We follow up to remove what was installed and find out what was touched.

This is the layer that catches it when someone clicks Yes anyway.

3. Two-step verification: a stolen password isn't enough

Phishing pages often ask for a password too, and a remote tool gives the attacker any password saved in the browser. With two-step verification on email, banking and accounting, a password alone doesn't get them in. Use an authenticator app or a security key where you can. Text messages are better than nothing, but easier to steal.

Two-step verification won't protect accounts already signed in on the compromised computer. That's why finding the remote tool fast matters.

Habits that help

• Keep a short list of the remote tools your business actually uses, and block the rest.
• Teach people to stop at "you need a viewer to open this." Real documents almost never need one. Our awareness training runs phishing tests built on lures like this.
• Confirm any change to payment details by calling a number you already have.

Not sure what's on your computers?

We can check. A security assessment looks at your computers, your accounts and how they're set up, and tells you what to fix first. If something is happening right now, report it or call 737-305-5448.

Rafael Pesquera, Digitaino Security