ScreenConnect Hacking: How a Fake Document Can Give Attackers Remote Access

Cybercriminals are constantly finding new ways to convince employees to click malicious links, and there's one increasingly concerning tactic in particular that we are seeing more and more everyday. Recently, we've seen a major uptake in a hacking technique that involves downloading remote-access software onto a victim's computer. Something like this can be severe, so we want to lay out all the information for you here.

Hackers are now disguising remote-access software as legitimate documents or PDFs in their emails. What may appear to be a typical business email can ultimately give an attacker complete remote access to the victim's entire computer, allowing them to search for sensitive information, attempt to access financial accounts, and make fraudulent purchases.

In this blog we're going to break down how this attack works and tell you exactly what to look out for.

It Starts With an Email

This attack typically begins with an email containing a link to what appears to be a PDF, invoice, document, or other legitimate file.

The email may use generic, but convincing language related to billing, payments, invoices, or account activity.

For example, a user may receive an email claiming that an invoice is ready to review or that a payment document is available. The message contains a link that appears to go to this document.

The link, however, does not go to the promised PDF.

The Remote Access Software

After clicking the link, the victim may download a file that appears to be the document they were expecting, only it's actually a ScreenConnect setup executable.

The victim isn't simply being tricked into opening a malicious PDF, they're being tricked into downloading and running software that can provide remote access to their computer.

Once the user clicks that fake document or PDF and follows the installation prompts, the remote-access software is installed.

At that point, the attacker will have a way to connect to the computer remotely.

Attackers Often Wait Until the Computer is Unattended

One of the more concerning aspects of this tactic is that the attacker doesn't necessarily need to act immediately. In fact, they'll often wait until the user is not using the computer to start searching for things.

Remote-access tools can allow attackers to determine whether a computer is active. Instead of taking action while the employee is sitting at their desk, an attacker may wait until the computer is unattended, often overnight.

Once connected, the attacker can interact with the computer much like a person sitting in front of it. They may open files, browse through folders, access web browsers, and look for saved credentials or other sensitive information.

The ultimate goal, however, is typically financial.

What Do They Look For?

Yep, you guessed it. They're looking to gain access to your financial accounts.

They may search the victim's browser for banking websites, accounting systems, payment platforms, or other services that could provide access to money. If they successfully gain access, the consequences can be significant, including unauthorized transfers or drained bank accounts.

If they're unable to access financial accounts, they may turn their intention to online shopping.

Attackers will try to access e-commerce websites such as Amazon and purchase expensive electronics, gift cards, or other big items that can be quickly resold.

How Can Businesses Protect Their Employees?

The first line of defense is awareness. Employees should always be cautious with unexpected emails containing links to documents, invoices, payment requests, or account notifications.

Before downloading a file, look closely at the email and consider whether you were actually expecting it. If an email seems suspicious, contact the sender through a known phone number or separate communication channel rather than replying to the message or clicking its link.

Employees should also pay attention to the type of file being downloaded. A PDF should look like a PDF, not an executable installation file. If a supposedly routine document prompts you to install software, stop and contact your IT team.

Businesses should also have safeguards in place beyond employee awareness. Endpoint protection, email security, multi-factor authentication, application controls, and proper access management can all help reduce the potential impact of a compromised computer.

Most importantly, employees should know who to contact if they accidentally download or run something suspicious. Reporting the mistake quickly can give an IT or security team an opportunity to isolate the computer and investigate before an attacker can do more damage.

Don't Let a Fake Document Become a Real Security Incident

A convincing email doesn't have to contain an obviously malicious attachment to be dangerous. Sometimes, all it takes is a link to a fake document and a user who believes they are opening a routine file.

Remote-access software can be a legitimate and useful business tool, but when attackers trick employees into installing it, it can become a gateway into the organization.

When in doubt, don't click, don't install, and don't assume that a familiar looking document is safe. A few extra seconds of caution can prevent an attacker from gaining access to an entire computer and potentially the financial accounts behind it.

If you notice that something doesn't look right, or are concerned about the possibility of something being fake, always reach out to your IT team. It's always better to be safe than sorry, and your IT team can help verify the validity of the email.