ScreenConnect Backdoor Delivered via SSA-Impersonation Phishing Lure

ScreenConnect Backdoor Delivered via SSA-Impersonation (TL-2026-2594) is a medium-severity malware campaign, first published 2026-09-14. It has no confirmed attribution, affects ConnectWise ScreenConnect Client (ScreenConnect.ClientSetup.exe, maps to 14 MITRE ATT&CK techniques (T1036.005, T1071.001, T1090), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-2594

Threat ID
TL-2026-2594
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
2026-09-14
Last reviewed
2026-09-14
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
consumers
Target regions
united states of america
Detection rules
9
Indicators of compromise
14

Malware and tooling in ScreenConnect Backdoor Delivered via SSA-Impersonation

Malware and tooling: ConnectWise - S0591, ScreenConnect, ScreenConnect SaaS relay (ConnectWise Cloud)

A phishing email impersonating the Social Security Administration used a shortened t[.]co link to funnel victims through a fake SSA statement portal at icci-sa[.]com into downloading a trojanized ScreenConnect.ClientSetup.exe installer, which established encoded/encrypted ScreenConnect C2 traffic to 15.204.43.235:443 via a legitimate ConnectWise SaaS relay hostname, giving the operator interactive remote access to the victim host.

How ScreenConnect Backdoor Delivered via SSA-Impersonation works

On 2026-09-13 at 14:05:42 UTC, a phishing email spoofing the U.S. Social Security Administration (sender 'Information@allsecured[.]net', source IP 23.227.202.93) was sent with the subject 'Your Monthly SSA Electronic Statement is Available for Download.' The email embedded a Twitter/X-shortened URL (t[.]co/LPz3zzwREa) that, when clicked, redirected the victim to an attacker-registered domain, icci-sa[.]com, hosting a fake SSA portal under /xgov/. The landing page (social_secur1tiy_administr3tion.php, using look-alike character substitution to evade string-based filtering) served a 'download statement' flow that, via a ?download=exe parameter, delivered ScreenConnect.ClientSetup.exe -- a 12,828,216-byte PE32 GUI executable (SHA-256 f1d103dd77d09697fa30fa14c4f39e394b0331a33ffd2ef5df2916dbe79e474b) -- to the victim.

ScreenConnect.ClientSetup.exe is the legitimate installer for ConnectWise ScreenConnect, a commercial remote monitoring and management (RMM) tool. Rather than exploiting a software flaw, the operator weaponized the installer itself: once executed, it silently provisioned a ScreenConnect client pre-configured to phone home to an attacker-controlled ScreenConnect cloud instance at instance-udppxf-relay.screenconnect.com, resolving to 15.204.43.235 on TCP/443. Because ConnectWise's own SaaS relay infrastructure and naming convention (instance-<id>-relay.screenconnect.com) is used as the C2 channel, the traffic is encoded/encrypted ScreenConnect protocol riding a signed, trusted binary and a legitimate-looking TLS destination -- both of which blend into normal RMM/IT-support traffic and evade domain- or binary-reputation-based controls. Once connected, ScreenConnect's built-in capabilities (remote desktop viewing/control, file transfer, and remote command execution) give the operator hands-on-keyboard access to the compromised host.

This capture matches a well-documented, recurring pattern: since at least 2024, multiple vendors (Cofense, Malwarebytes, GridinSoft, Cyble, Kaseya) have reported waves of SSA-impersonation phishing that abuse ScreenConnect (and, in parallel campaigns, SimpleHelp) as the payload, typically followed by credential-harvesting pages requesting SSNs, banking details, and phone-carrier PINs, or by delivery of additional RATs (e.g., AdaptixC2, XWorm) for redundant access. The allsecured[.]net sender domain independently carries a large complaint history on spam/abuse trackers (1,000+ registrar/DNS complaints per Spam.org), consistent with recycled phishing infrastructure. No CVE applies -- delivery is entirely social-engineering-driven abuse of a legitimate, signed RMM installer, not exploitation of a vulnerability. This is also unrelated to the concurrently disclosed ConnectWise ScreenConnect vulnerability CVE-2026-84869 (added to the CISA KEV catalog 2026-09-11), which involves file-transfer/execution abuse by a low-privileged session on an existing ScreenConnect deployment rather than a trojanized first-run installer; the two should not be conflated. No attribution to a specific threat actor or group is available in current reporting for this specific infrastructure set. Severity is assessed MEDIUM pending confirmation of scale and targeting beyond this single traffic capture; realized compromise carries a HIGH impact given the full interactive remote-access capability granted.

MITRE ATT&CK techniques used in TL-2026-2594

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1102.002 Bidirectional Communication; T1219 Remote Access Tools; T1573 Encrypted Channel

Execution

T1204.002 Malicious File

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1585.002 Email Accounts; T1608.001 Upload Malware; T1608.005 Link Target

Affected products and versions in ScreenConnect Backdoor Delivered via SSA-Impersonation

  • ConnectWise — ScreenConnect Client (ScreenConnect.ClientSetup.exe installer)
    Vulnerable versions: Not a software vulnerability -- legitimate signed installer abused via social engineering; version 26.3.x line observed in comparable SSA-lure captures
    Fixed in: N/A -- mitigated via RMM allowlisting, application control, and user awareness, not patching
  • Microsoft — Windows (any version capable of running the ScreenConnect client)
    Vulnerable versions: All Windows versions targeted by the social-engineering delivery chain
    Fixed in: N/A

Remediation for ScreenConnect Backdoor Delivered via SSA-Impersonation

Immediate actions

  • Block/sinkhole IOCs at perimeter and email gateway: icci-sa[.]com, allsecured[.]net, instance-udppxf-relay.screenconnect.com, 15.204.43.235, 23.227.202.93.
  • Hunt for ScreenConnect.ClientSetup.exe (SHA-256 f1d103dd77d09697fa30fa14c4f39e394b0331a33ffd2ef5df2916dbe79e474b) execution or the instance ID 'udppxf' across endpoint telemetry.
  • Quarantine and remove any unauthorized ScreenConnect client instance found connecting to non-approved relay hostnames.
  • Reset credentials and monitor accounts for any host where the installer executed, given the RAT's full remote-control capability.

Workarounds

  • Restrict outbound access to *.screenconnect.com relay subdomains to only pre-approved, IT-provisioned instance IDs where technically feasible.
  • Block execution of unsigned or newly-downloaded RMM installers via application control (e.g., AppLocker/WDAC) for non-IT endpoints.

Longer-term hardening

  • Maintain an allowlist of approved RMM/remote-access vendors and instance IDs; alert on any ScreenConnect (or other RMM) install/connection outside that allowlist.
  • Deploy EDR detection for ScreenConnect (and similar RMM) process trees spawned from browser-downloaded installers rather than IT-managed deployment channels.
  • Deploy DNS/web filtering that inspects redirect chains through URL shorteners (t.co and similar) rather than trusting the shortener domain's reputation alone.
  • Run recurring user-awareness training on government-impersonation phishing (SSA, IRS, etc.) themes.

Timeline of ScreenConnect Backdoor Delivered via SSA-Impersonation

  • ScreenConnect client establishes encoded/encrypted C2 traffic to instance-udppxf-relay.screenconnect.com (15.204.43.235:443), granting the operator interactive remote access to the victim host.
  • Victim executes the trojanized ScreenConnect.ClientSetup.exe installer, silently provisioning a ScreenConnect client on the host.
  • ScreenConnect.ClientSetup.exe (SHA-256 f1d103dd77d09697fa30fa14c4f39e394b0331a33ffd2ef5df2916dbe79e474b, 12,828,216 bytes) is downloaded via the page's ?download=exe parameter.
  • Victim is served the fake SSA statement download page at icci-sa[.]com/xgov/social_secur1tiy_administr3tion.php.
  • Shortened link redirects the victim to the attacker-controlled fake SSA portal hosted at icci-sa[.]com/xgov/.
  • Victim clicks the embedded t[.]co/LPz3zzwREa shortened URL contained in the phishing email.
  • Phishing email impersonating the U.S. Social Security Administration sent from Information@allsecured[.]net (source IP 23.227.202.93) at 14:05:42 UTC, subject 'Your Monthly SSA Electronic Statement is Available for Download'.
  • Malware-Traffic-Analysis.net publishes the full PCAP, phishing email, and malware sample analysis of the incident.

Sources cited for ScreenConnect Backdoor Delivered via SSA-Impersonation

More in malware

Detection coverage for TL-2026-2594

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2594 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats