Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Three unrelated incidents in August 2026 exploited diverse initial access vectors (tech support scam, phishing MSI, fake refund form) to deploy rogue ScreenConnect clients that execute a four-stage VBScript worm-like chain The attack chain uses a state-variable system (1.vbs through 4.vbs) to profile infected hosts and deliver tailored payloads based on detected security tools and system configuration Worm-like propagation occurs as compromised ScreenConnect clients distribute the VBScript chain
62
Hot
65
Quality
55
Impact
Analysis
TL;DR
- Three unrelated incidents in August 2026 exploited diverse initial access vectors (tech support scam, phishing MSI, fake refund form) to deploy rogue ScreenConnect clients that execute a four-stage VBScript worm-like chain
- The attack chain uses a state-variable system (1.vbs through 4.vbs) to profile infected hosts and deliver tailored payloads based on detected security tools and system configuration
- Worm-like propagation occurs as compromised ScreenConnect clients distribute the VBScript chain to newly connected Host systems, effectively turning each infected machine into a content-delivery mechanism
- Three distinct payload branches were identified: user-level ScreenConnect backdoors (state 000/001), UAC bypass and persistence tooling (state 010), and cryptocurrency mining with Defender disabling (state 011)
- ConnectWise acknowledged a file transfer behavior vulnerability in ScreenConnect affecting both Cloud and On-Premise deployments, while Huntress recommends full system re-imaging for affected hosts
Why It Matters
This incident demonstrates how legitimate remote administration tools can be weaponized for worm-like propagation, creating a self-sustaining infection mechanism that spreads laterally through trusted IT support channels—a tactic that could bypass many perimeter defenses. The sophisticated state-aware payload selection and multi-stage VBScript architecture represents an evolution in RMM-based attack chains that security teams should monitor closely.
Technical Details
- Initial Access Vectors: Three distinct entry points were observed—a Quick Assist tech-support scam, a phishing-delivered MSI installer (ScreenConnect.ClientSetup.msi), and a fake Geek Squad refund form lure—each deploying a rogue ScreenConnect client configured to communicate with attacker-controlled C2 servers
- Four-Stage VBScript Chain: 1.vbs profiles the host (RAM check, ScreenConnect installation status, security product enumeration including CrowdStrike, SentinelOne, Sophos, etc.) and writes a three-bit state variable to %TEMP%\value.txt; 2.vbs waits for value.txt and downloads a mapping file from Dropbox to %TEMP%\map.txt; 3.vbs reads the map and downloads the appropriate payload to %TEMP%\out.enc; 4.vbs decrypts the payload via runner.ps1 and executes PyTorchFix.ps1
- State-Based Payload Branching: State values 000/001 deliver a user-level ScreenConnect backdoor; state 010 delivers UAC bypass and persistence tooling; state 011 delivers tunneling utilities, an XMRig cryptocurrency miner, and scripts to disable Microsoft Defender reporting and Windows memory integrity
- Worm Propagation Mechanism: The compromised client records ConnectionIDs to avoid re-targeting active sessions but removes them upon disconnection, allowing reconnections to trigger reinfection; VBScript files are persisted to C:\Users\Public\Libraries\Default\Lib\Lib1 to serve as delivery mechanism for new connections
- Persistence & Cleanup: A WindowsServiceHost User Run Key pointing to WindowsServiceHost.vbs in AppData provides persistence; runner.ps1 terminates all wscript.exe and cscript.exe processes and deletes the staging directory after execution
Industry Insight
- Organizations using ScreenConnect or similar RMM tools should immediately audit all remote support sessions, verify client installations against known-good configurations, and implement network-level monitoring for anomalous wscript.exe spawning patterns from RMM software
- The worm-like propagation behavior through legitimate remote administration channels highlights the critical need for endpoint detection and response (EDR) solutions to establish behavioral baselines for RMM tools and alert on unexpected file transfer or script execution patterns
- Given the complexity of the infection and the persistence mechanisms employed, incident response playbooks should prioritize full system re-imaging over remediation attempts, and ConnectWise's acknowledged vulnerability should prompt all ScreenConnect customers to apply security patches and review file transfer configurations across both Cloud and On-Premise deployments
Disclaimer: The above content is generated by AI and is for reference only.
Security Research
Related Articles
The Download: the hunt for underground hydrogen and more rogue OpenAI agents
Monitoring and Authorization for AI Agents: the Model's Own Judgment is not a Permission Check
OpenAI reports AI "research interns" and warns about its own pace at the same time
OpenAI Agents Hijack Another Victim Website
Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits