Attackers Wield Signed ConnectWise Installers as Malware

Researchers are tracking a rise in online attacks involving legitimate ConnectWise software that’s been turned into malware, and sometimes disguised as AI image converters or PDF files.

See Also: Combatting the Vulnerability Prioritization Challenge: A Guide to DVE Intelligence

ConnectWise, based in Florida, builds IT remote access tools used by organizations to remotely take control of employees’ systems for troubleshooting, maintenance and update purposes. Many managed service providers use it to maintain remote fleets of endpoints on behalf of customers.

A recent wave of ConnectWise software abuse by attackers began in March, and often involves attackers using phishing emails to trick victims into installing samples of ConnectWise that have been validly signed by the vendor, but subverted for malicious purposes, warns a new report from Germany-based security firm G Data.

The ConnectWise ScreenConnect – formerly known as ConnectWise Control and also as ScreenConnect – remote access tool “is the most popularly abused legitimate remote access tool and accounted for 56% of all active threat reports with legitimate remote access tools in 2024,” cybersecurity firm Cofense said in a May report.

This campaign, tracked as “EvilConwi,” has succeeded in part due to “bad signing practices” on the part of ConnectWise. Attackers have abused “this legitimate software to build and distribute their own signed malware,” researchers Lance Go and Karsten Hahn write in the report.

The researchers say that they traced the malicious use of legitimate ConnectWise software to attackers using Authenticode stuffing – the “deliberate misuse of the certificate structure that allows modifications to an executable without invalidating its signature” – to make weaponized versions of the software appear to be legitimate.

Many legitimate types of software, including ConnectWise, as well as Dropbox and others, use Authenticode code signing to create personalized installers for client-side applications so an endpoint automatically connects to a designated server without a user having to configure settings.

Authenticode is designed to verify that a file hasn’t been tampered with or prove to an end user that it’s legitimate.

Because each of these personalized installers are slightly different – since they come configured with settings tied to the individual user – developers long ago discovered a somewhat controversial workaround that lets them place any needed settings data, which is unverified and unsigned, in the certificate table for a file. This allows a file to pass Authenticode checks, and means the organization doesn’t have to generate and sign a brand-new installer for every new user download.

The risk is that attackers access the certificate table and alter it for their own purposes. That allows them to link the installed software to a server they control to suppress application behavior that might look suspicious, all while using a fake Windows update screen to trick users into not interrupting the infection process.

G Data has published samples of Yara rules that defenders can use to help detect ConnectWise software that’s been modified for malicious purposes. This includes reviewing ConnectWise samples’ app.config for specific settings, such as silent installation being enabled, or application icons, messages to users or tray icons being disabled.

The researchers said they shared their findings with ConnectWise on June 12, including malicious samples seen in the wild, and saw on June 17 “that the signature used to sign the samples was revoked.”

ConnectWise didn’t immediately respond to a request for comment.

If subverted, a legitimate remote access tool provides an easy platform for infecting systems with malware, including ransomware, without an attacker having to gain initial access in some more laborious way and install their own malicious software for infecting the system with malware.

Repeat Target

Hackers have long targeted remote access tools, especially when already installed on systems.

Hackers in February 2024 targeted two high-risk vulnerabilities affecting ScreenConnect servers and ScreenConnect clients, tracked as CVE-2024-1708 and CVE-2024-1709, to deploy ransomware, information-stealing malware and cryptocurrency miners (see: Attackers Rush to Exploit ScreenConnect Vulnerabilities).

Security experts traced the February 2024 breach of Change Healthcare, a unit of Optum owned by UnitedHealth Group, to a ransomware group that targeted the flaw to gain initial access (see: Change Healthcare Now Counts 190 Million Data Breach Victims).

In the first five months of this year, the quantity of new reports of malicious campaigns tied to ConnectWise’s remote-access tool equaled the total quantity seen for all of 2024.

One campaign that began last fall involved malicious emails purporting to deliver Social Security benefits statements, which directed recipients to click on an included link which would typically go to a supposed statement download site, or begin downloading the supposed statement, Cofense said. What gets downloaded is an installer for ConnectWise configured to connect to an attacker-controlled command-and-control server.

The same goes for another, more recent campaign. In February, researchers began seeing emails purporting to notify a recipient that a PDF for them was available to download via the files.fm cloud storage site, which led to a file purportedly from Microsoft OneDrive being downloaded, which was in fact a ConnectWise RAT installer configured for malicious purposes, Cofense said.