ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

VBScript chain

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Modified ScreenConnect Clients Used in Worm-Like Campaign

Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.

Campaigns starting in late August use social engineering, including Quick Assist abuse, to install rogue ScreenConnect clients that spawn wscript.exe and deploy four VBScript files for reconnaissance, staging, and PowerShell execution. The attackers persist via User Run Keys, attempt UAC bypass, install UltraViewer, and propagate the VBScript chain to other connected ScreenConnect endpoints. ConnectWise published an advisory about a file transfer behavior issue affecting cloud and on-premises ScreenConnect, with a CVE identifier and fix expected within a week; it recommends disabling file transfer meanwhile.

SecurityWeek · 8d agoExploit / PoC in the wild

Appears with

malware rogue ScreenConnect client 1organization ConnectWise 1organization Huntress 1product Quick Assist 1product ScreenConnect 1product UltraViewer 1vendor ConnectWise 1vendor Huntress 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.