ConnectWise RAT Abuse Surge: Exploiting Trust For Cyber Intrusions

Published Date: June 2, 2025

Category: ShadowOpsIntel

In 2025, ConnectWise ScreenConnect emerged as the most abused legitimate RAT, appearing in 56% of active threat reports involving legitimate RATs in 2024 and already showing comparable attack volumes in 2025. Attackers trick users with fake communications – like emails claiming to be from the US Social Security Administration or notifications about shared files – to distribute these RATs. Other tools like Atera, FleetDeck, and smaller RATs (e.g., GoTo RAT, Gooxion RAT) are also being weaponized.

Severity Level: High

Campaigns And RAT Abuse Patterns

ConnectWise ScreenConnect: 56% of all active threat reports involving legitimate RATs in 2024.
- Tactics:
  - Exploits 14-day free trial (drops to free tier with 3-agent limit post-expiry).
  - C2 hosted via ConnectWise cloud or attacker-controlled infrastructure (port 8041).
  - Malware payload is usually .exe, disguised as PDF viewer or document.
- Notable Campaigns:
  - Social Security Administration Spoof: Phishing emails with benefit-themed lures.
  - Files[.]fm Spoof: Shared file-themed emails delivering links to ConnectWise RAT installer or phishing pages.
Atera + Splashtop Integration: Legitimately used for Remote monitoring/management by IT teams.
- Threat Vector:
  - 30-day free trial exploited for unrestricted access.
  - Atera used to deploy Splashtop for covert access.
- Campaigns
  - Brazilian Legal Notice Spoof: Portuguese-language emails impersonating labour courts.
  - Later samples included invoice-themed lures.
FleetDeck: Rarely used legitimately due to outdated software (last update: April 2022). Shared C2 infrastructure means blocking FleetDeck’s C2 endpoint disrupts all traffic.
- Campaigns:
  - Finance-themed Emails in French and German, urging users to install a tool to open fake invoice PDFs (posing as “Adobe FleetDeck”).
Other Tools Observed:
- GoTo RAT: Formerly LogMeIn Resolve; used in English-language order invoice scams.
- Gooxion RAT: Chinese-language finance campaigns.
- PDQ Connect: Portuguese-themed finance lures.
- Teramind: Spoofed Italian cybersecurity agency (Agenzia per la Cybersicurezza Nazionale).

Recommendations:

Conduct regular security audits and baseline reviews of legitimate RAT usage.
Implement strict access control policies – limit RAT usage to verified personnel and enforce MFA.
Block or quarantine suspicious emails containing fake legal notices, shared file notifications, or benefit statement lures.
Educate staff to recognize phishing attempts, especially those masquerading as legitimate entities.
Block the IOCs on respective controls:
https://www.virustotal.com/gui/collection/945804e38a9912211c3df0f4363847e92b6573fd7a4fb60bb9876a2555396a9a/iocs.

MITRE ATT&CK

Tactic	Technique	ID	Details
Reconnaissance	Acquire Infrastructure: Domains	T1583.001	Threat actors registered custom domains for phishing (e.g., verify.uniupdate[.]net).
Resource Development	Obtain Capabilities: Tool	T1588.002	Actors obtained legitimate RATs (e.g., ConnectWise, Atera).
Initial Access	Phishing: Spearphishing Link	T1566.002	Phishing emails with malicious download links (SSA, legal, or invoice-themed).
Execution	User Execution: Malicious File	T1204.002	Victims execute spoofed installers disguised as PDFs or viewers.
Execution	Native API	T1106	Legitimate RATs execute using system APIs.
Persistence	External Remote Services	T1133	RATs establish persistent remote access through tools like Splashtop, ScreenConnect.
Command and Control	Application Layer Protocol: Web Protocols	T1071.001	RATs use HTTPS for secure C2 (e.g., via ports like 8041).
Command and Control	Ingress Tool Transfer	T1105	Download and execution of RATs and follow-on payloads.
Exfiltration	Exfiltration Over C2 Channel	T1041	RATs enable data exfiltration directly over HTTPS or via their own secure tunnels.

Source:

https://hackread.com/connectwise-screenconnect-tops-abused-rats-2025/
https://cofense.com/blog/new-weapon-of-choice-how-threat-actors-hijack-legitimate-remote-access-tools

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.