Modified ScreenConnect Clients Used in Worm-Like Campaign
Modified ScreenConnect clients are being weaponized in a worm-like attack campaign since late August to propagate malicious payloads across connected endpoints The attack chain uses four VBScript files for reconnaissance, payload staging, and PowerShell execution, followed by a second PowerShell script that erases evidence, attempts UAC bypass, and installs a concealed rogue ScreenConnect client for lateral propagation Attackers gain initial access primarily through social engineering, including
Analysis
TL;DR
- Modified ScreenConnect clients are being weaponized in a worm-like attack campaign since late August to propagate malicious payloads across connected endpoints
- The attack chain uses four VBScript files for reconnaissance, payload staging, and PowerShell execution, followed by a second PowerShell script that erases evidence, attempts UAC bypass, and installs a concealed rogue ScreenConnect client for lateral propagation
- Attackers gain initial access primarily through social engineering, including tech support impersonation via Windows Quick Assist and phishing, then establish persistence via User Run Keys and install UltraViewer remote desktop software
- ConnectWise has acknowledged a file transfer vulnerability in ScreenConnect affecting both cloud and on-premises deployments, with a CVE and official fix expected soon
- Huntress recommends administrators apply extra scrutiny to on-premises ScreenConnect installations and disable file transfer functionality as an immediate mitigation
Why It Matters
This campaign demonstrates how legitimate remote access tools can be subverted into worm-like propagation vectors, turning a single compromised endpoint into a gateway for widespread lateral movement within connected environments. For AI and security practitioners, it underscores the critical importance of monitoring for modified or unauthorized instances of trusted software and the need for zero-trust principles in remote support tool deployments.
Technical Details
- The attack begins with social engineering (tech support impersonation via Quick Assist or phishing) to deploy a rogue ScreenConnect client on the victim machine
- Once installed, the malicious client spawns repeated Windows Script Host (wscript.exe) child processes to deploy four VBScript files from the ScreenConnect temporary directory, designed for system reconnaissance, payload staging, and PowerShell execution
- A second PowerShell script erases staging evidence, attempts UAC bypass, and installs a concealed ScreenConnect client that continuously monitors for new host connections to propagate the four-stage VBScript chain laterally
- Persistence is established through a User Run Key registry entry pointing to an additional VBScript file, alongside installation of UltraViewer remote desktop software
- ConnectWise confirmed a file transfer behavior vulnerability in ScreenConnect Remote Access Support and Access sessions affecting both cloud and on-premises deployments, with a CVE and patch forthcoming
Industry Insight
- Organizations relying on on-premises ScreenConnect should immediately audit all installations, disable file transfer functionality until a patch is available, and monitor for unauthorized ScreenConnect processes or unexpected wscript.exe spawning
- The worm-like propagation mechanism highlights the need for network segmentation and strict endpoint monitoring around remote access tools, as a single compromised machine can rapidly become a distribution node
- This campaign reflects a growing trend of threat actors abusing legitimate remote support infrastructure for lateral movement; security teams should treat any unexpected remote access tool installation as a high-priority indicator of compromise and enforce application whitelisting where possible
Disclaimer: The above content is generated by AI and is for reference only.