Samantha Clarke and the Mimecast Threat Research team have identified an ongoing credential harvesting campaign (designated MCTO3030) that specifically targets ScreenConnect cloud administrators. This sophisticated operation has maintained consistent tactics, techniques, and procedures since 2022, demonstrating remarkable operational security through low-volume distribution that has allowed it to operate largely undetected.
The campaign employs spear phishing emails delivered through Amazon Simple Email Service (SES) accounts, targeting senior IT professionals including directors, managers, and security personnel with elevated privileges in ScreenConnect environments. The attackers specifically seek super administrator credentials, which provide comprehensive control over remote access infrastructure across entire organizations.
Once the user clicks upon the Review Security button they are directed to one of two types of phishing pages:
Example number 1
Example number 2
What makes this campaign particularly concerning is its apparent connection to ransomware operations. Research from Sophos indicates similar ScreenConnect targeting by Qilin ransomware affiliates, suggesting these credential harvesting activities serve as initial access vectors for subsequent ransomware deployment
The harvested super admin credentials enable attackers to push malicious ScreenConnect clients or instances to multiple endpoints simultaneously, facilitating rapid lateral movement and ransomware distribution.
The persistent nature of this campaign and its connection to ransomware operations make it a significant threat to organizations relying on ScreenConnect for remote access management. The combination of sophisticated AITM techniques and targeted approach toward high-privilege users requires a multi-layered defensive strategy combining technical controls, user education, and proactive monitoring.
The threat actors leverage Amazon SES for email distribution due to its high deliverability rates, low cost, and ease of setup. These accounts are often created using compromised credentials or sold through underground markets, allowing attackers to bypass traditional email security controls through trusted infrastructure.
The phishing pages employ sophisticated adversary-in-the-middle (AITM) techniques using the EvilGinx framework, an open-source tool designed for intercepting both credentials and multi-factor authentication (MFA) codes. This capability allows the attackers to bypass modern authentication protections and maintain persistent access to compromised accounts.
Domain infrastructure utilizes country code top-level domains (CCTLDs) with ScreenConnect-themed naming conventions, creating convincing impersonations of legitimate ConnectWise/ScreenConnect portals. The consistent use of these naming patterns across multiple years demonstrates a successful operational model that the threat actors continue to exploit.
Mimecast has implemented detection capabilities specifically targeting this campaign’s characteristics, including Amazon SES abuse patterns, ScreenConnect impersonation indicators, and AITM phishing techniques. Our threat research team continues monitoring for tactical evolution and infrastructure changes to ensure comprehensive protection.
Senior IT professionals, IT directors, system administrators, and security personnel with ScreenConnect super administrator privileges across all region and industries.
Domains
Infrastructure Characteristics
User Awareness Training
Technical Security Controls
Proactive Threat Hunting
Email Security Enhancement
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
