I am writing to request a feature enhancement for both the consumer and endpoint protection suites regarding how Bitdefender handles legitimate, signed commercial remote administration tools (such as ConnectWise ScreenConnect, AnyDesk, and TeamViewer).
Currently, threat actors heavily abuse these official, signed binaries as Remote Access Trojans (RATs) in "Living off the Land" style attacks. Because Bitdefender silently trusts the valid digital certificates of these enterprise tools, malicious deployments are completely undetected and allowed to run and maintain persistent outbound connections to rogue servers.
Recently, while conducting security testing, my system was targeted by a multi-stage loader deploying an obfuscated Remote Access Trojan (RAT). While Bitdefender's Advanced Threat Control (ATC) successfully detected the initial custom payloads once executed, the threat actor ultimately dropped and executed a standard, unmodified, officially signed ConnectWise ScreenConnect binary to establish persistent remote access.
Because the ScreenConnect client carries a valid corporate digital signature, Bitdefender silently trusted it and allowed it to maintain an established outbound network connection, bypassing all local static and dynamic alerts. To an everyday user, this creates an invisible administrative backdoor that an attacker can exploit at will.
While I understand that Bitdefender prioritizes minimizing false positives in corporate environments where these tools are legal, consumer and security-conscious users need visibility.
Proposed Solution:
Please add an optional, toggleable feature under Protection Settings (similar to the current PUA scanner) specifically for "Riskware / Dual-Use Administration Tools."
When enabled, Bitdefender should alert the user if a remote access utility is being initialized on the disk, giving them the option to "Allow," "Block," or "Quarantine" the file. This closes a massive security blind spot without disrupting users who prefer a completely silent out-of-the-box experience.
