Skip to navigation

Threat reportMalwareTL-2026-2594

ScreenConnect Backdoor Delivered via SSA-Impersonation Phishing Lure

mediumACTIVE

A phishing email impersonating the Social Security Administration used a shortened t[.]co link to funnel victims through a fake SSA statement portal at icci-sa[.]com into downloading a trojanized ScreenConnect.ClientSetup.exe installer, which established encoded/encrypted ScreenConnect C2 traffic to 15.204.43.235:443 via a legitimate ConnectWise SaaS relay hostname, giving the operator interactive remote access to the victim host.

Key facts for ScreenConnect SSA phishing

IdentifiersTL-2026-2594
SeverityMEDIUM
Exploitation statusExploited in the wild
Affected productsConnectWise ScreenConnect Client (ScreenConnect.ClientSetup.exe installer); Microsoft Windows (any version capable of running the ScreenConnect client)
ToolsConnectWise - S0591, ScreenConnect, ScreenConnect SaaS relay (ConnectWise Cloud)
MITRE ATT&CK techniquesT1036.005 Match Legitimate Resource Name or Location, T1071.001 Web Protocols, T1090 Proxy, T1102.002 Bidirectional Communication, T1204.002 Malicious File, T1219 Remote Access Tools, T1566.002 Spearphishing Link, T1573 Encrypted Channel, T1583.001 Domains, T1583.006 Web Services, T1585.002 Email Accounts, T1608.001 Upload Malware and 2 more in the attack flow
MotivationFINANCIAL
Target sectorsconsumers
Target regionsunited states of america
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for ScreenConnect SSA phishing

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2594 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ScreenConnect SaaS Relay Beacon to Unauthorized Instance ID (C2 over Legitimate ConnectWise Cloud)

Detects outbound TCP/443 connections or DNS resolutions to the abused ConnectWise ScreenConnect SaaS relay hostname instance-udppxf-relay.screenconnect.com / 15.204.43.235, or to any *.screenconnect.com relay subdomain whose instance ID is not on the organization's approved-instance allowlist — the encoded/encrypted C2 channel that rides trusted RMM SaaS infrastructure to give the operator interactive remote access.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1071.001, T1573, T1102.002, T1090, T1219
  • Data sources: firewall_logs, dns_logs, proxy_logs, ms_defender_devicenetworkevents, netflow
  • Severity: critical
  • Confidence: high

Splunk SPL

index=network OR index=firewall OR index=dns OR index=proxy
(dest_ip="15.204.43.235" OR dest="15.204.43.235" OR query="*.screenconnect.com" OR dest_domain="*.screenconnect.com")
| eval unauthorized_instance=if(match(query,"instance-udppxf-relay") OR match(dest_domain,"instance-udppxf-relay") OR dest_ip="15.204.43.235",1,0)
| eval approved_instance_list="lookup:approved_screenconnect_instances.csv"
| lookup approved_screenconnect_instances.csv instance_id AS extracted_instance OUTPUT approved
| where unauthorized_instance=1 OR isnull(approved)
| stats count, values(dest_port) as ports, earliest(_time) as first_seen, latest(_time) as last_seen by src_ip, dest_ip, dest_domain, unauthorized_instance
| eval beacon_duration_sec=last_seen-first_seen
| where dest_port=443 OR ports="443" OR unauthorized_instance=1

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == "15.204.43.235" or RemoteUrl has "instance-udppxf-relay.screenconnect.com" or RemoteUrl has ".screenconnect.com"
| where RemotePort == 443
| extend UnauthorizedInstance = RemoteUrl has "udppxf" or RemoteIP == "15.204.43.235"
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, UnauthorizedInstance
| where UnauthorizedInstance == true
| sort by ConnectionCount desc

Sigma

title: ScreenConnect SaaS Relay C2 Beacon to Unauthorized Instance (instance-udppxf-relay)
id: 4d8a2c17-6b91-4e3f-a5d0-1c7e9b3f8a44
status: experimental
description: Detects network connections on TCP/443 to the ConnectWise ScreenConnect cloud relay hostname instance-udppxf-relay.screenconnect.com or its resolved IP 15.204.43.235, an unauthorized ScreenConnect relay instance abused as an encrypted C2 channel riding legitimate SaaS infrastructure.
references:
    - https://www.malware-traffic-analysis.net/2026/09/14/index.html
    - https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1573
    - attack.t1102.002
    - attack.t1090
    - attack.tool.screenconnect
logsource:
    category: network_connection
    product: windows
detection:
    sel_ip:
        DestinationIp: '15.204.43.235'
    sel_domain:
        DestinationHostname|contains: 'instance-udppxf-relay.screenconnect.com'
    sel_port:
        DestinationPort: 443
    condition: (sel_ip or sel_domain) and sel_port
falsepositives:
    - IT-provisioned, allowlisted ScreenConnect instance IDs connecting to legitimate *.screenconnect.com relays for authorized remote support; correlate against the org's approved-instance-ID allowlist before alerting
level: critical

Known false positives:

  • Legitimate IT/helpdesk ScreenConnect sessions to approved instance IDs on *.screenconnect.com; requires a maintained approved-instance allowlist to suppress routine RMM traffic

Tuning notes: Populate and continuously update the approved_screenconnect_instances lookup/allowlist with IT-provisioned instance IDs so only unapproved instances (or the specific IOC 15.204.43.235 / udppxf instance) fire; add beacon-interval/jitter statistics (stdev of inter-connection deltas) once a baseline of legitimate RMM session cadence is established to reduce reliance on the static IOC alone.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SSA-Impersonation Phishing Redirect to Trojanized ScreenConnect Installer Download · unlock with TL Creds
  • Trojanized [indicator] Silent Install from Non-IT Delivery Channel · unlock with TL Creds
  • ScreenConnect SaaS Relay Beacon to Unauthorized Instance ID (C2 over Legitimate ConnectWise Cloud) · unlock with TL Creds
  • SSA-Impersonation Phishing Redirect to Trojanized ScreenConnect Installer Download · unlock with TL Creds
  • Trojanized [indicator] Silent Install from Non-IT Delivery Channel · unlock with TL Creds
  • ScreenConnect SaaS Relay Beacon to Unauthorized Instance ID (C2 over Legitimate ConnectWise Cloud) · unlock with TL Creds
  • SSA-Impersonation Phishing Redirect to Trojanized ScreenConnect Installer Download · unlock with TL Creds
  • Trojanized [indicator] Silent Install from Non-IT Delivery Channel · unlock with TL Creds

Indicators of compromise for ScreenConnect SSA phishing

As of 2026-09-14, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-2594.

Sample indicators (3 of 14)

  • IP address: 23.227.202[.]93
  • Domain: icci-sa[.]com
  • URL: hxxps://t[.]co/LPz3zzwREa

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

14 indicators of compromise · unlock with TL Creds. Compare plans

How ScreenConnect SSA phishing works

On 2026-09-13 at 14:05:42 UTC, a phishing email spoofing the U.S. Social Security Administration (sender 'Information@allsecured[.]net', source IP 23.227.202.93) was sent with the subject 'Your Monthly SSA Electronic Statement is Available for Download.' The email embedded a Twitter/X-shortened URL (t[.]co/LPz3zzwREa) that, when clicked, redirected the victim to an attacker-registered domain, icci-sa[.]com, hosting a fake SSA portal under /xgov/. The landing page (social_secur1tiy_administr3tion.php, using look-alike character substitution to evade string-based filtering) served a 'download statement' flow that, via a ?download=exe parameter, delivered ScreenConnect.ClientSetup.exe -- a 12,828,216-byte PE32 GUI executable (SHA-256 f1d103dd77d09697fa30fa14c4f39e394b0331a33ffd2ef5df2916dbe79e474b) -- to the victim.

ScreenConnect.ClientSetup.exe is the legitimate installer for ConnectWise ScreenConnect, a commercial remote monitoring and management (RMM) tool. Rather than exploiting a software flaw, the operator weaponized the installer itself: once executed, it silently provisioned a ScreenConnect client pre-configured to phone home to an attacker-controlled ScreenConnect cloud instance at instance-udppxf-relay.screenconnect.com, resolving to 15.204.43.235 on TCP/443. Because ConnectWise's own SaaS relay infrastructure and naming convention (instance-<id>-relay.screenconnect.com) is used as the C2 channel, the traffic is encoded/encrypted ScreenConnect protocol riding a signed, trusted binary and a legitimate-looking TLS destination -- both of which blend into normal RMM/IT-support traffic and evade domain- or binary-reputation-based controls. Once connected, ScreenConnect's built-in capabilities (remote desktop viewing/control, file transfer, and remote command execution) give the operator hands-on-keyboard access to the compromised host.

This capture matches a well-documented, recurring pattern: since at least 2024, multiple vendors (Cofense, Malwarebytes, GridinSoft, Cyble, Kaseya) have reported waves of SSA-impersonation phishing that abuse ScreenConnect (and, in parallel campaigns, SimpleHelp) as the payload, typically followed by credential-harvesting pages requesting SSNs, banking details, and phone-carrier PINs, or by delivery of additional RATs (e.g., AdaptixC2, XWorm) for redundant access. The allsecured[.]net sender domain independently carries a large complaint history on spam/abuse trackers (1,000+ registrar/DNS complaints per Spam.org), consistent with recycled phishing infrastructure. No CVE applies -- delivery is entirely social-engineering-driven abuse of a legitimate, signed RMM installer, not exploitation of a vulnerability. This is also unrelated to the concurrently disclosed ConnectWise ScreenConnect vulnerability CVE-2026-84869 (added to the CISA KEV catalog 2026-09-11), which involves file-transfer/execution abuse by a low-privileged session on an existing ScreenConnect deployment rather than a trojanized first-run installer; the two should not be conflated. No attribution to a specific threat actor or group is available in current reporting for this specific infrastructure set. Severity is assessed MEDIUM pending confirmation of scale and targeting beyond this single traffic capture; realized compromise carries a HIGH impact given the full interactive remote-access capability granted.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1102.002 Bidirectional Communication; T1219 Remote Access Tools; T1573 Encrypted Channel

Execution

T1204.002 Malicious File

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1585.002 Email Accounts; T1608.001 Upload Malware; T1608.005 Link Target

Remediation for ScreenConnect SSA phishing

Immediate actions

  • Block/sinkhole IOCs at perimeter and email gateway: icci-sa[.]com, allsecured[.]net, instance-udppxf-relay.screenconnect.com, 15.204.43.235, 23.227.202.93.
  • Hunt for ScreenConnect.ClientSetup.exe (SHA-256 f1d103dd77d09697fa30fa14c4f39e394b0331a33ffd2ef5df2916dbe79e474b) execution or the instance ID 'udppxf' across endpoint telemetry.
  • Quarantine and remove any unauthorized ScreenConnect client instance found connecting to non-approved relay hostnames.
  • Reset credentials and monitor accounts for any host where the installer executed, given the RAT's full remote-control capability.

Workarounds

  • Restrict outbound access to *.screenconnect.com relay subdomains to only pre-approved, IT-provisioned instance IDs where technically feasible.
  • Block execution of unsigned or newly-downloaded RMM installers via application control (e.g., AppLocker/WDAC) for non-IT endpoints.

Longer-term hardening

  • Maintain an allowlist of approved RMM/remote-access vendors and instance IDs; alert on any ScreenConnect (or other RMM) install/connection outside that allowlist.
  • Deploy EDR detection for ScreenConnect (and similar RMM) process trees spawned from browser-downloaded installers rather than IT-managed deployment channels.
  • Deploy DNS/web filtering that inspects redirect chains through URL shorteners (t.co and similar) rather than trusting the shortener domain's reputation alone.
  • Run recurring user-awareness training on government-impersonation phishing (SSA, IRS, etc.) themes.

Affected and fixed versions

  • ConnectWise — ScreenConnect Client (ScreenConnect.ClientSetup.exe installer)
    Vulnerable versions: Not a software vulnerability -- legitimate signed installer abused via social engineering; version 26.3.x line observed in comparable SSA-lure captures
    Fixed in: N/A -- mitigated via RMM allowlisting, application control, and user awareness, not patching
  • Microsoft — Windows (any version capable of running the ScreenConnect client)
    Vulnerable versions: All Windows versions targeted by the social-engineering delivery chain
    Fixed in: N/A

Timeline of ScreenConnect SSA phishing

  • locked-ioc-13 client establishes encoded/encrypted C2 traffic to locked-ioc-5 (locked-ioc-12:443), granting the operator interactive remote access to the victim host.
  • Victim executes the trojanized locked-ioc-7 installer, silently provisioning a locked-ioc-13 client on the host.
  • locked-ioc-7 (SHA-256 locked-ioc-2, 12,828,216 bytes) is downloaded via the page's ?download=exe parameter.
  • Victim is served the fake SSA statement download page at locked-ioc-14/xgov/social_secur1tiy_administr3tion.php.
  • Shortened link redirects the victim to the attacker-controlled fake SSA portal hosted at locked-ioc-14/xgov/.
  • Victim clicks the embedded t[.]co/LPz3zzwREa shortened URL contained in the phishing email.
  • Phishing email impersonating the U.S. Social Security Administration sent from Information@locked-ioc-10 (source IP locked-ioc-11) at 14:05:42 UTC, subject 'Your Monthly SSA Electronic Statement is Available for Download'.
  • Malware-Traffic-Analysis.net publishes the full PCAP, phishing email, and malware sample analysis of the incident.

Sources cited for ScreenConnect SSA phishing

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats