Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers

Huntress has identified a concerning trend involving unauthorized guest sessions on ScreenConnect servers, masked under crypto exchange-themed names. This discovery, which affects at least 118 self-hosted ScreenConnect servers across 109 organizations, highlights potential risks for managed service providers (MSPs). While no malicious activities have yet been directly linked to these sessions, they could serve as bait for attacks exploiting known vulnerabilities.

The unauthorized sessions, detected since November 3, 2026, originate from machines with names resembling crypto exchanges, such as KUCOIN-SRV and LAPTOP-BINANCE. These sessions are believed to be generated by a scripted emulator mimicking a Windows ScreenConnect client, primarily connecting from a single IONOS-hosted IP address. Although no malicious actions have been observed so far, the sessions could potentially be used to lure technicians into opening them, creating opportunities for exploitation.

A critical vulnerability in ScreenConnect, identified as CVE-2026-84869, has raised further concern. This flaw allows a malicious guest to execute files on a vulnerable technician client. A technician might be tempted to open a session labeled as a 'crypto server', which could lead to exploitation. While there is no evidence linking the unauthorized sessions directly to this vulnerability, the possibility of such attacks remains a risk for organizations using ScreenConnect.

The issue was brought to light when an MSP noticed unfamiliar machines named after crypto exchanges in their ScreenConnect console. These machines had no identifiable owner and appeared online without any installation by the MSP. Upon investigation, Huntress found no signs of web shells or suspicious processes on the server, but the sessions were legitimate entries in the server's database. This prompted a broader investigation, revealing thousands of similar unauthorized sessions across multiple servers.

ScreenConnect, a remote desktop software, is widely used by MSPs to connect to customer computers. It requires a server's relay address, embedded in the server's guest installer, to register a guest client. In one case, an MSP's installer was publicly accessible, allowing unauthorized sessions to be created. Most of these sessions connected from a single IP, with some early instances from an Egyptian residential IP. These sessions are actively maintained, with operators reconnecting them frequently to keep them appearing online.

While Huntress has not found evidence of malicious activity from these sessions, the potential for exploitation remains. The ScreenConnect vulnerability CVE-2026-84869, although patched, still poses a threat if technicians are lured into interacting with these fake sessions. Organizations must ensure their systems are updated and secure against such vulnerabilities.