Attackers disguise sessions on 100+ ScreenConnect servers
Original title: Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers
Huntress says the unauthorized remote sessions were labeled with cryptocurrency exchange names.
Huntress reports attackers used cryptocurrency exchange names to disguise unauthorized sessions on more than 100 ScreenConnect servers. The provided text does not name victims, a vulnerability, malware, or a patch.
Unconfirmed: The article body was not included, so actor, method, and impact beyond the title are unconfirmed.
- More than 100 ScreenConnect servers had unauthorized sessions.
- Session names referenced cryptocurrency exchanges.
- No CVE, victim, or malware family is named in the provided text.
Impact: unauthorized remote sessions on ScreenConnect servers
| Product | Affected |
|---|---|
| ScreenConnect | — |
- Products
- ScreenConnect
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 197.47.160.252 | .]106, which is IONOS SE-hosted. Another early instance was 197.47.160[.]252, an Egyptian residential IP, which created the first thre |
| ipv4 | 74.208.158.106 | The majority of these sessions connected from a single IP,74.208.158[.]106, which is IONOS SE-hosted. Another early instance was 197 |
| ipv4 | 87.106.111.220 | rst three unauthorized sessions on Nov 3, 2026, 21:26 UTC 87.106.111[.]220 Related IONOS host (same JARM and TLS certificates as 74. |
| sha256 | 008839ef2a2d54e9efa47013bb23c773d3a152f351e9dfd3b2f4dd27086121df | ntType 1 Combined server-side fingerprint of the emulator 008839ef2a2d54e9efa47013bb23c773d3a152f351e9dfd3b2f4dd27086121df WebP preview thumbnail (Binance-style page), most-used bait |
| sha256 | 45136a9ab47015c4334b881df9daf824a72347daae0b5730ce3bd7d42b204bf2 | view thumbnail (Binance-style page), most-used bait image 45136a9ab47015c4334b881df9daf824a72347daae0b5730ce3bd7d42b204bf2 WebP preview thumbnail (bait image family 2) e73020645e7a |
| sha256 | b55ce5130cd2623017cca29318341f6b4656e3a1dc5ab82ce704e912d0d17535 | 84a1a140f0d7 WebP preview thumbnail (bait image family 4) b55ce5130cd2623017cca29318341f6b4656e3a1dc5ab82ce704e912d0d17535 WebP preview thumbnail (bait image family 5) bea82efc8267 |
| sha256 | bea82efc82672225cf29eb869972670754f15941bc61b9e5801ffd41c5c39e5f | e912d0d17535 WebP preview thumbnail (bait image family 5) bea82efc82672225cf29eb869972670754f15941bc61b9e5801ffd41c5c39e5f WebP preview thumbnail (bait image family 6) f6d37291c494 |
| sha256 | c15b008b0296b1bc9e0f979e6f25b780e3e89edabb344c7ee8c284a1a140f0d7 | 2a2da7fbd91f WebP preview thumbnail (bait image family 3) c15b008b0296b1bc9e0f979e6f25b780e3e89edabb344c7ee8c284a1a140f0d7 WebP preview thumbnail (bait image family 4) b55ce5130cd2 |
| sha256 | e73020645e7a11a90865d93bd7f3d797585f49ef72b1ac7354392a2da7fbd91f | d7d42b204bf2 WebP preview thumbnail (bait image family 2) e73020645e7a11a90865d93bd7f3d797585f49ef72b1ac7354392a2da7fbd91f WebP preview thumbnail (bait image family 3) c15b008b0296 |
| sha256 | f6d37291c4948b974caf2e9e7e8ca9c2173d2779d1ec0a391488706bbd1a995c | fd41c5c39e5f WebP preview thumbnail (bait image family 6) f6d37291c4948b974caf2e9e7e8ca9c2173d2779d1ec0a391488706bbd1a995c WebP preview thumbnail (bait image family 7) • Summariz |
From the original article
12 min read at huntress.comFake crypto exchange sessions are showing up on ScreenConnect servers and could be bait for technicians. See what Huntress found and what to do.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.