{"id":11692,"date":"2026-03-25T13:06:53","date_gmt":"2026-03-25T13:06:53","guid":{"rendered":"https:\/\/events.aavar.org\/avar2025\/?page_id=11692"},"modified":"2026-03-25T13:06:54","modified_gmt":"2026-03-25T13:06:54","slug":"connectunwise-how-threat-actors-abuse-connectwise-installer-as-builder-for-signed-malware","status":"publish","type":"page","link":"https:\/\/events.aavar.org\/avar2025\/index.php\/connectunwise-how-threat-actors-abuse-connectwise-installer-as-builder-for-signed-malware\/","title":{"rendered":"ConnectUnwise: How Threat Actors Abuse ConnectWise installer as Builder for Signed Malware"},"content":{"rendered":"\n[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column]\n\n\n\n
\n
\n
<\/div>\n\n\n\n

AGENDA<\/p>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n\n\n\n

[\/vc_column] [\/vc_row]<\/p>\n\n\n\n

<\/div>\n\n\n\n

<— Back<\/a><\/strong><\/p>\n\n\n\n

ConnectUnwise: How Threat Actors Abuse ConnectWise installer as Builder for Signed Malware<\/p>\n\n\n\n

In March 2025, we noticed and started tracking an unusually high number of ConnectWise-based malware. ConnectWise is a remote desktop application usually used by tech support to provide remote assistance. This new malware campaign weaponized trust in an unexpected way: by delivering validly signed ConnectWise ScreenConnect installers repurposed as remote access malware. These binaries were distributed via phishing emails, cloud platforms or AI related websites. These samples managed to pass traditional AV detection signature checks and appear benign \u2013 all while handing attackers control of the victim\u2019s desktop without visible warnings such as tray icons or prompts or with fake Windows update messages and application icons.<\/p>\n\n\n\n

A technique known as Authenticode stuffing made this campaign possible. Custom configuration data of ConnectWise such as command-and-control server addresses, user messages, background images or UI suppression flags are embedded into the installer\u2019s certificate table \u2013 a section not covered by Authenticode\u2019s hashing. This allows threat actors to build their own remote access malware while retaining ConnectWise\u2019s valid authenticode signature.<\/p>\n\n\n\n

Our analysis compared different variations of ConnectWise samples which revealed that only differences between the binaries were found within the certificate data. Using tools such as PortexAnalyzer and Authenticode Lint, we extracted this data, reverse engineered its structure and wrote a config extractor. To detect abused ConnectWise installers, we created YARA rules which search for suspicious configurations strings (such as those controlling UI elements).<\/p>\n\n\n\n

While the Certificate Authority has revoked the abused certificate as of June 2025, numerous variations of the malware remain in circulation using similar techniques. In line with this, we\u2019ll be presenting how we have managed to detect this unusual form of malware with the hopes of shifting the balance of power between cyber threats and defense.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\n
\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n

Lance Jansen Caoile Go – GData AV Lab Inc<\/strong><\/strong><\/strong><\/strong><\/p>\n\n\n\n

Lance Go is a cybersecurity professional with 3 years of experience in the field. He mainly focuses on malware research and is always on the lookout for new and interesting threats.  Throughout his career, he has sought out opportunities to learn from more experienced professionals to continuously refine and improve his own workflow. He is currently pursuing a Master\u2019s Degree in Computer Science at the University of the Philippines Diliman, where his thesis focuses on image-based malware analysis. Outside of academics and work, Lance enjoys a variety of hobbies including freediving, flying drones, playing badminton, and building automations. His friendly and inquisitive nature allows him to meet people from diverse backgrounds and learn skills across a wide range of fields.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n

Karsten Hahn –<\/strong> GData Cyberdefense AG<\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n\n\n\n

Karsten Hahn has a Master’s Degree in Computer Science from HTWK Leipzig. His master thesis about static Portable Executable analysis won the FBTI Award in 2015, which is doted at 1000 Euro. Since 2015 he works for GDATA CyberDefense AG. At the time he started as Malware Analyst, moved to a Lead Engineer position in 2022, where he was responsible for protection engineering of GDATA’s new MEDR product. He became Principal Malware Researcher in 2024 and is now responsible for threat research, blog article writing and internal trainings.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column] AGENDA [\/vc_column] [\/vc_row] <— Back ConnectUnwise: How Threat Actors Abuse ConnectWise installer as Builder for Signed Malware In March 2025, we noticed and started tracking an unusually high number of ConnectWise-based malware. ConnectWise is a remote desktop application usually used by tech support to provide remote assistance. This new malware campaign weaponized trust in an<\/p>\n

<\/div>\n

Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-11692","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/comments?post=11692"}],"version-history":[{"count":1,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11692\/revisions"}],"predecessor-version":[{"id":11695,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11692\/revisions\/11695"}],"wp:attachment":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/media?parent=11692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}