HACKERS TURN SCREENCONNECT INTO MALWARE USING AUTHENTICODE STUFFING

Summary from the TLDR InfoSec newsletter

Cybersecurity firm G DATA is warning users of ConnectWise's ScreenConnect remote monitoring and management (RMM) software about a new malware campaign that utilizes ScreenConnect installers with a malicious configuration embedded in the authenticode certificate. The malicious installer is configured to have the title “Windows Update,” change the background to a Windows Update image, and connect to an attacker-controlled server. ConnectWise has revoked the certificates used in these binaries.