Ransomware Operator ScreenConnect Relay Backdoor Abuse (Interlock/RansomHub)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.