# ScreenConnect Backdoor Delivered via SSA-Impersonation Phishing Lure

> A phishing email impersonating the Social Security Administration used a shortened t[.]co link to funnel victims through a fake SSA statement portal at icci-sa[.]com into downloading a trojanized ScreenConnect.ClientSetup.exe installer, which established encoded/encrypted ScreenConnect C2 traffic to 15.204.43.235:443 via a legitimate ConnectWise SaaS relay hostname, giving the operator interactive remote access to the victim host.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2594
- **ID:** TL-2026-2594
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-13 at 14:05:42 UTC, a phishing email spoofing the U.S. Social Security Administration (sender 'Information@allsecured[.]net', source IP 23.227.202.93) was sent with the subject 'Your Monthly SSA Electronic Statement is Available for Download.' The email embedded a Twitter/X-shortened URL (t[.]co/LPz3zzwREa) that, when clicked, redirected the victim to an attacker-registered domain, icci-sa[.]com, hosting a fake SSA portal under /xgov/. The landing page (social_secur1tiy_administr3tion.php, using look-alike character substitution to evade string-based filtering) served a 'download statement' flow that, via a ?download=exe parameter, delivered ScreenConnect.ClientSetup.exe -- a 12,828,216-byte PE32 GUI executable (SHA-256 f1d103dd77d09697fa30fa14c4f39e394b0331a33ffd2ef5df2916dbe79e474b) -- to the victim.

ScreenConnect.ClientSetup.exe is the legitimate installer for ConnectWise ScreenConnect, a commercial remote monitoring and management (RMM) tool. Rather than exploiting a software flaw, the operator weaponized the installer itself: once executed, it silently provisioned a ScreenConnect client pre-configured to phone home to an attacker-controlled ScreenConnect cloud instance at instance-udppxf-relay.screenconnect.com, resolving to 15.204.43.235 on TCP/443. Because ConnectWise's own SaaS relay infrastructure and naming convention (instance-<id>-relay.screenconnect.com) is used as the C2 channel, the traffic is encoded/encrypted ScreenConnect protocol riding a signed, trusted binary and a legitimate-looking TLS destination -- both of which blend into normal RMM/IT-support traffic and evade domain- or binary-reputation-based controls. Once connected, ScreenConnect's built-in capabilities (remote desktop viewing/control, file transfer, and remote command execution) give the operator hands-on-keyboard access to the compromised host.

This capture matches a well-documented, recurring pattern: since at least 2024, multiple vendors (Cofense, Malwarebytes, GridinSoft, Cyble, Kaseya) have reported waves of SSA-impersonation phishing that abuse ScreenConnect (and, in parallel campaigns, SimpleHelp) as the payload, typically followed by credential-harvesting pages requesting SSNs, banking details, and phone-carrier PINs, or by delivery of additional RATs (e.g., AdaptixC2, XWorm) for redundant access. The allsecured[.]net sender domain independently carries a large complaint history on spam/abuse trackers (1,000+ registrar/DNS complaints per Spam.org), consistent with recycled phishing infrastructure. No CVE applies -- delivery is entirely social-engineering-driven abuse of a legitimate, signed RMM installer, not exploitation of a vulnerability. This is also unrelated to the concurrently disclosed ConnectWise ScreenConnect vulnerability CVE-2026-84869 (added to the CISA KEV catalog 2026-09-11), which involves file-transfer/execution abuse by a low-privileged session on an existing ScreenConnect deployment rather than a trojanized first-run installer; the two should not be conflated. No attribution to a specific threat actor or group is available in current reporting for this specific infrastructure set. Severity is assessed MEDIUM pending confirmation of scale and targeting beyond this single traffic capture; realized compromise carries a HIGH impact given the full interactive remote-access capability granted.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1585.002 Email Accounts
- T1608.001 Upload Malware
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1102.002 Bidirectional Communication
- T1090 Proxy

## Sources

- [2026-09-14 - ScreenConnect backdoor traffic analysis](https://www.malware-traffic-analysis.net/2026/09/14/index.html)
- [Hackers Spoof Social Security Administration to Deliver ScreenConnect Remote Access Tool](https://cofense.com/blog/hackers-spoof-social-security-administration-to-deliver-screenconnect-remote-access-tool)
- [Social Security Statement Email Scam: ScreenConnect RMM](https://blog.gridinsoft.com/social-security-statement-screenconnect-scam/)
- [Allsecured.net Safety Review (Domain Reputation)](https://gridinsoft.com/online-virus-scanner/url/allsecured-net)
- [Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts](https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html)
- [CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV](https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html)
- [Zoom phishing: Fake SSA alerts & ConnectWise ScreenConnect abuse](https://www.kaseya.com/blog/zoom-phishing-campaign-threat-actors-faking-ssa-alerts/)
- [Op Report From SSA Phish to AdaptixC2: A Multi-RAT Intrusion](https://blog.deception.pro/blog/xworm-sc-hok-may-2026)
- [Fake Social Security Statement emails trick users into installing remote tool](https://www.malwarebytes.com/blog/news/2025/04/fake-social-security-statement-emails-trick-users-into-installing-remote-tool)
- [Scammers Exploit ScreenConnect To Defraud SSA Beneficiaries](https://cyble.com/blog/scammers-use-screenconnect-to-defraud-ssa-beneficiaries/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2594