Detecting and Mitigating Phishing URLs Delivering RMM Payloads and Malicious ScreenConnect Clients

Introduction

Have you encountered phishing URLs that masquerade as legitimate remote monitoring and management (RMM) tools? Recently, security teams have observed a surge in phishing campaigns delivering malicious RMM payloads, including trojanized versions of the ScreenConnect clientsetup.exe installer. These attacks exploit trusted remote access software to gain persistent control over endpoints, complicating detection and response efforts.

This article breaks down why these phishing URLs are effective, illustrates how attackers deliver RMM payloads, and provides practical steps for detection, investigation, and prevention tailored for MSP SOC analysts and IT security leads.

---

Understanding Why Attackers Use Phishing URLs to Deliver RMM Payloads

Phishing URLs delivering RMM payloads capitalize on the inherent trust organizations place in remote management tools. Here's why this technique is rising:

• Trusted Software Abuse: ScreenConnect (now ConnectWise Control) is widely used by MSPs for endpoint management, making it an ideal vehicle for attackers to blend malicious payloads with legitimate-looking installers.
• Bypassing Security Filters: Malicious URLs often use domains like keepgreentb.com - a domain recently linked to phishing campaigns - to evade reputation-based detection.
• Remote Access Trojan (RAT) Deployment: Trojanized ScreenConnect clients allow attackers to establish persistent backdoors, often undetected due to signed installers and legitimate-looking certificates.

Real-World Example

In Q1 2024, multiple campaigns were identified where phishing URLs hosted on keepgreentb.com delivered a malicious ScreenConnect client setup. The installer dropped multiple RATs, facilitating unauthorized remote control and lateral movement within networks.

Do This Now: Monitor your network for any inbound connections or executable downloads originating from suspicious domains such as keepgreentb.com.

---

Detecting Malicious URLs and Suspicious RMM Payload Delivery

Effective detection hinges on correlating threat intelligence with endpoint monitoring. Follow these strategies:

1. Leverage Threat Intel Feeds: Subscribe to feeds reporting phishing URLs linked to RMM payloads. For example, OffSeq.com and Threat Radar provide updated lists of URLs distributing trojanized ScreenConnect installers.
2. Analyze URL Characteristics: Malicious URLs often use:
3. Slight domain variations resembling legitimate services.
4. Non-standard ports or uncommon download paths.
5. Endpoint Monitoring and Alerting: Implement alerts for unexpected executions of clientsetup.exe or unusual ScreenConnect activity.
6. Inspect Network Traffic: Look for anomalous outbound connections from endpoints to unfamiliar remote access servers.

Detection Method	Description	Tools/Examples
Threat Intel Integration	Use feeds listing known phishing URLs	OffSeq.com, VirusTotal
URL Reputation Analysis	Domain and URL pattern inspection	Cisco Talos, Palo Alto DNS
Endpoint Behavior Analysis	Monitor new processes and network connections	CrowdStrike, SentinelOne

Do This Now: Implement automated scanning of URLs and executables against threat intelligence before allowing downloads or execution.

---

Investigating Indicators of Remote Access Trojan Activity

When suspecting an endpoint compromise via RMM payloads, look for these indicators:

• Unexpected running instances of ScreenConnect services or related processes.
• Persistence mechanisms such as scheduled tasks or registry run keys spawning clientsetup.exe.
• Unusual inbound remote connections from IPs not associated with legitimate MSP tools.
• Presence of additional payloads dropped by the installer, such as VBScript chains or secondary RATs.

Example Incident

A mid-sized MSP detected multiple endpoints showing signs of ScreenConnect client payloads executing from %TEMP% directories. The attack involved a four-stage VBScript chain spreading laterally, which was traced back to a phishing URL. Immediate containment and forensic analysis prevented further damage.

Do This Now: Conduct endpoint scans for known persistence artifacts and verify legitimacy of all installed remote access clients.

---

Steps to Remove Malicious ScreenConnect Payloads and Restore Endpoint Integrity

Removing trojanized RMM payloads requires a thorough approach:

1. Isolate Affected Systems: Prevent further lateral movement.
2. Terminate Malicious Processes: Identify and kill unauthorized ScreenConnect or RAT processes.
3. Remove Persistence Entries: Clean scheduled tasks, startup directories, and registry keys related to malicious clients.
4. Reinstall Legitimate RMM Software: Download fresh installers directly from trusted vendors.
5. Update Endpoint Security: Ensure antivirus and EDR signatures are current.

Removal Phase	Actions	Recommended Tools
Isolation	Network segmentation	Firewall rules, NAC
Process Termination	Kill malicious executables	Process Explorer, Task Manager
Persistence Cleanup	Registry and task scheduler inspection	Autoruns, Regedit
Software Reinstallation	Download from official ConnectWise site	ConnectWise Control official

Do This Now: Document all remediation steps and verify endpoints are free from unauthorized remote access clients before reconnecting to production networks.

---

Prevention Tips: Hardening Against RMM Phishing Campaigns

To reduce risk exposure, adopt these preventive measures:

• User Awareness Training: Educate staff on recognizing phishing URLs, especially those mimicking trusted RMM tools.
• Multi-Factor Authentication (MFA): Enforce MFA on all remote access portals, including ScreenConnect.
• Strict Application Whitelisting: Only allow approved installers from verified sources.
• Regular Threat Intelligence Updates: Integrate feeds that track evolving phishing domains like keepgreentb.com.
• Network Segmentation: Limit RMM tool access to dedicated subnets.

Comparison Table: Common Prevention Controls

Control	Description	Impact on RMM Phishing Risk
User Training	Improves phishing link identification	High
MFA	Adds authentication barrier	Medium
Application Whitelisting	Blocks unauthorized executables	High
Threat Intel Integration	Early detection of phishing URLs	Medium
Network Segmentation	Limits spread of compromise	High

Do This Now: Implement layered controls combining user, technical, and network defenses to minimize attack surface.

---

FAQ

What is ScreenConnect phishing?

ScreenConnect phishing involves attackers sending emails or messages with URLs that lead to trojanized ScreenConnect client installers. These malicious payloads grant attackers unauthorized remote access.

How can I identify if an RMM payload is malicious?

Indicators include unexpected install locations, unsigned executables, unknown network connections, and alerts from endpoint security tools triggered by RMM-related files.

What makes keepgreentb.com suspicious?

This domain has been linked to recent phishing campaigns delivering RMM trojans. Its use in URLs should be treated as a red flag.

How does malicious ScreenConnect clientsetup.exe differ from legitimate versions?

Malicious versions often include backdoor payloads or RATs alongside the base installer, may be unsigned, or have altered file hashes.

What immediate steps should be taken after detecting a phishing URL delivering RMM malware?

Isolate affected devices, block the URL and domain on firewalls, conduct forensic analysis, and remove any unauthorized RMM installations.

---

Conclusion

Phishing URLs distributing malicious RMM payloads and trojanized ScreenConnect installers represent a growing threat to MSPs and IT security teams. Attackers exploit trusted remote access tools to bypass defenses and establish persistent control. By combining vigilant URL monitoring, endpoint analysis, and layered prevention controls, SOC analysts and IT leads can detect, investigate, and mitigate these sophisticated attacks effectively.

Prioritize integrating threat intelligence, enforcing strict application controls, and educating users to reduce the risk of endpoint management compromise. This proactive approach will strengthen your security posture against evolving RMM phishing campaigns.