ScreenConnect Session Relaying Across Multiple Distinct Client Networks

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•3

Detects instances where the ScreenConnect remote support client initiates outbound network connections to an unusually high number of distinct remote IP addresses (greater than 5). This behavior is characteristic of unauthorized lateral movement, reconnaissance, or establishing multiple C2 tunnels via a legitimate RMM tool.