Abuse of Faronics Deploy for Remote Execution and Persistence

Security researchers have identified a campaign involving the abuse of Faronics Deploy, a cloud-based IT management and endpoint administration platform. Attackers who gain unauthorized access to the Faronics Deploy management console leverage the platform's legitimate "Deploy" and "Scripting" features to push malicious payloads and administrative commands to registered endpoints. Because these actions are executed by the legitimate Faronics management agent (typically running with elevated system-level privileges), the activity often appears as benign administrative traffic. This technique allows adversaries to establish long-term persistence, move laterally, and deploy additional tooling across an organization without triggering traditional security alerts that focus on external initial access. The lack of anomalous process behavior, combined with the trusted nature of the management agent, makes this a high-impact vector for organizations relying on centralized administration tools.

Attack Chain

1. Attacker gains unauthorized access to a Faronics Deploy management console (e.g., via stolen credentials or session hijacking).
2. Attacker logs into the console and identifies target endpoints within the management scope.
3. Attacker uses the "Scripting" or "Software Deployment" function to upload a malicious script or executable.
4. The Faronics Deploy cloud console sends a task signal to the Faronics agent residing on the target Windows endpoint.
5. The Faronics agent process on the endpoint receives the instruction to execute the payload.
6. The agent spawns a child process (typically cmd.exe or powershell.exe) to execute the malicious script or binary.
7. The malicious code runs with SYSTEM privileges on the host to establish persistence or exfiltrate data.
8. The agent reports task success back to the Faronics console, maintaining the illusion of legitimate administration.

Impact

Successful abuse of Faronics Deploy allows attackers to bypass perimeter security, achieve full remote control over enterprise endpoints, and deploy ransomware or information stealers. Because the agent executes with SYSTEM privileges, attackers effectively inherit total control over all managed assets, leading to significant risk of data exfiltration and widespread operational disruption within the targeted corporate environment.

Recommendation

Prioritize monitoring of the Faronics management agent to detect suspicious sub-processes or unexpected execution patterns.

• Restrict access to the Faronics Deploy management console to authorized personnel only, enforcing multi-factor authentication for all sessions.
• Implement monitoring for the Faronics agent process spawning interactive shells like cmd.exe or powershell.exe.
• Audit the "Scripts" library and recent deployment tasks within the Faronics console to identify unauthorized or anomalous administrative activity.