Tag: evilconwi

1 Attack Reports | 0 Vulnerabilities

Attack reports

Threat Actors abuse signed ConnectWise application as malware builder

Since March 2025, there has been an increase in infections using validly signed ConnectWise samples. Threat actors are exploiting ConnectWise's authenticode stuffing practices to create and distribute their own signed malware. The malicious samples use modified settings in the certificate table to …
remote access
CVE-2024-1709
certificate abuse
fake updates
signed malware
2025-06-24
connectwise
CVE-2024-1708
authenticode stuffing
evilconwi
unauthenticated attributes
Published: June 24, 2025
Linked vulnerabilities : CVE-2024-1709, CVE-2024-1708
Downloadable IOCs: 30
Click here to see more Attack Reports