Hackers Exploit ConnectWise Configuration to Develop Signed Malware

C that maintains valid digital signatures.

This attack campaign, ongoing from late 2024 into 2025, has been designated “EvilConwi.”

It has exploited weaknesses in how ConnectWise manages authenticode signatures and configuration storage, leading to the widespread deployment of evasive, signed malware.

ConnectWise has previously been a focus for cybercriminals, especially following the disclosure of CVE-2024-1708 and CVE-2024-1709 in early 2024.

The most recent attack wave began in March 2025, with users reporting infections via phishing emails leading to customized ConnectWise installers.

Victims described symptoms such as mouse movements with no explanation, fake Windows Update screens, and hidden remote control activity.

Worryingly, as late as May 2025, most major antivirus engines failed to flag these tampered installers as malicious.

Authenticode Stuffing as an Attack Vector

Attackers are exploiting a technique known as “Authenticode stuffing,” wherein unauthenticated attributes are inserted into the certificate table of a Portable Executable (PE) file.

Because these attributes are not included in Windows’ hash verification of the file’s digital signature, modifications to the configuration such as adding custom resources or altering behavior flags do not break the signature.

This practice, which is generally tolerated by software vendors for benign purposes like installer tracking, becomes a potent security risk when abused.

Comparative analysis of malicious and legitimate ConnectWise samples reveals that the only significant difference is found within the certificate table.

Attackers embed XML configuration data, icon resources, and other payloads alongside the signed code.

These changes allow arbitrary rebranding of the client, scriptable launches, silent installs, the suppression of user interface indicators (like tray icons or warning dialogs), and even the display of fake screens to camouflage ongoing remote sessions.

Glove-Fit for Social Engineering

Phishing remains the primary infection vector, with links disguised as OneDrive or Canva documents, or disguised installers for popular software (Zoom, OneDrive, Adobe, etc.).

Once executed, the weaponized ConnectWise client can impersonate legitimate update processes or other trusted applications.

The attackers’ extensive use of custom icons and fake background images (e.g., fake Windows Update) is intended to minimize user suspicion and maximize dwell time for remote access.

The configuration, typically stored in XML or .NET resources within the certificate, governs all facets of the malware’s behavior.

Notably, flags to disable tray icons, alert balloons, and background changes during connection are set to “false” in most malicious samples making detection harder for end users.

Additional resources extracted include misleading application titles and icon changes, with some samples even themed to match Google Chrome or other well-known brands.

Security researchers strongly recommend defenders block or scrutinize any ConnectWise sample in which critical app.config settings such as ShowBalloonOnConnect, HideWallpaperOnConnect, or ShowSystemTrayIcon are set to false.

YARA rules can be constructed to identify these configurations directly in authenticode-stuffed certificate tables.

According to the Report, G DATA and other security vendors have updated detection engines to flag such samples as Win32.Backdoor.EvilConwi or Win32.Riskware.SilentConwi.

However, the inherent design flaw allowing unsigned, behaviorally critical configuration changes within a signed binary remains a risk.

ConnectWise was notified of the findings and revoked the offending certificate’s signature as of June 17, 2025, but has yet to issue a public statement.

Until software practices shift, signed malware leveraging this method will remain a notable threat across enterprise and consumer environments.

IOCs (Indicators of Compromise)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates