Hackers Exploit Faronics Deploy Platform to Seize Remote Control of Target Systems

Cybersecurity researchers have identified a sophisticated campaign in which threat actors abused the legitimate Faronics Deploy endpoint-management platform to establish unauthorized remote administrative control over victim computers. The attack, detected on Sept. 1, 2026, involved the misuse of trusted enterprise software to bypass security defenses and install ScreenConnect, a remote support tool, on compromised endpoints.

The operation leveraged the inherent trust organizations place in Faronics Deploy, a widely used solution for managing software deployments and system configurations across corporate networks. By exploiting this legitimate channel, attackers were able to execute commands with high-level privileges, effectively turning the management platform into a weapon for intrusion. Once initial access was secured through the compromised deployment mechanism, the actors deployed ScreenConnect to create persistent remote access channels.

The installation of ScreenConnect served a dual purpose in the attack chain. It provided the threat actors with immediate, direct control over the infected machines, allowing them to navigate file systems, execute commands, and exfiltrate data without triggering standard intrusion detection alerts associated with unauthorized remote desktop protocols. Furthermore, the software established redundant access pathways, ensuring that even if one entry point was discovered and blocked by defenders, the attackers could maintain their foothold through alternative channels.

The timing of the activity, recorded at 21:05 UTC on Sept. 1, suggests a coordinated effort to exploit systems during active business hours or transition periods when administrative tasks are common. The use of legitimate software in this manner highlights a growing trend where adversaries focus on supply chain vulnerabilities and trusted vendor tools rather than relying solely on malicious code delivery.

Security experts note that the abuse of endpoint-management platforms like Faronics Deploy presents a significant challenge for traditional defense mechanisms. Because the traffic originates from authorized sources and utilizes valid credentials or certificates, it often blends seamlessly with legitimate administrative activity. This makes detection difficult without advanced behavioral analysis capable of distinguishing between routine maintenance tasks and malicious exploitation.

The specific scope of the campaign remains unclear, as investigators have not yet determined the number of organizations targeted or the geographic distribution of the attacks. It is also unknown whether the actors successfully exfiltrated sensitive data or if the primary objective was to establish a long-term presence for future operations. As organizations scramble to audit their endpoint-management configurations and review access logs, the incident underscores the critical need for strict oversight of administrative tools and the implementation of zero-trust architectures to limit the potential impact of compromised credentials.