Crypto Exchange Names Used to Mask Unauthorized ScreenConnect Sessions
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited publicly accessible guest installer links on over 118 ScreenConnect servers to register more than 2,200 unauthorized remote sessions, disguising them with legitimate-sounding crypto exchange names to avoid suspicion. The core failure was that guest access was left open without adequate restrictions or vetting, allowing anyone to create sessions that blended in with normal activity. Because monitoring was insufficient, these sessions persisted for over 10 days before discovery, and in at least one case a technician unknowingly sent keystrokes to a fraudulent session, risking credential exposure. This incident illustrates how permissive remote access configurations combined with weak session visibility can create a stealthy foothold for attackers before any overtly malicious action is even taken.
Tactical Insight
Immediate actions
- Audit and disable all publicly accessible guest installer links on ScreenConnect servers that are not explicitly required for business operations.
- Review all active and recent ScreenConnect sessions for unrecognized or suspicious names and terminate unauthorized ones immediately.
Long-term improvements
- Restrict session creation to authenticated, approved users only and enforce allowlisting of permitted session names or organizations.
- Implement multi-factor authentication for all ScreenConnect administrator and technician accounts to prevent misuse of legitimate credentials.
- Establish a formal review process for remote access tool configurations as part of periodic security assessments.
Detection measures
- Deploy alerting for unusual session creation patterns, including sessions with names matching external organizations or high session volume spikes.
- Maintain comprehensive audit logs of all ScreenConnect session activity and integrate them into a SIEM for continuous monitoring and anomaly detection.