Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.
- Three August 2026 incidents used Quick Assist scams, phishing MSI installers, and Geek Squad refund lures for initial access
- Four chained VBScripts profile hosts, enumerate security tools, and pull stage-specific payloads from Dropbox
- Payload branches deliver a ScreenConnect backdoor, UAC-bypass tooling, or tunneling utilities plus an XMRig miner
- Backdoored clients re-infect newly connected hosts, creating worm-like propagation over ScreenConnect sessions
- Huntress recommends reimaging affected hosts; ConnectWise issued an advisory on affected file transfer behavior
- Vendors
- ConnectWise
- Products
- ScreenConnect
- Organizations
- HuntressConnectWise
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | anondns.net | nConnect.Client.exe"), which then connected to "borertors92.anondns[.]net." The session then uses "wscript.exe" to execute the four |
| domain | opik.net | ontrol (C2) server located at "45.13.237[.]190" ("tele-sync.opik[.]net"). Hosted on the IP address is a RAR archive containing t |
| ipv4 | 131.123.40.98 | oyed a ScreenConnect client configured to communicate with "131.123.40[.]98" on port 8041. The rogue ScreenConnect almost immediately |
| ipv4 | 45.13.237.190 | ed to contact a command-and-control (C2) server located at "45.13.237[.]190" ("tele-sync.opik[.]net"). Hosted on the IP address is a |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.