Attackers use rogue ScreenConnect clients to spread malware
Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.
ConnectWise confirmed a file transfer flaw in ScreenConnect affecting both Cloud and On-Premise deployments, with a CVE identifier and official fix promised within the week; administrators can mitigate immediately by disabling TransferFiles (or TransferFilesInSession) in each role. Huntress documented incidents where social engineering installs rogue ScreenConnect clients that spawn Windows Script Host processes running four VBScript files (1.vbs-4.vbs), add a WindowsServiceHost registry Run key, and propagate to newly connected endpoints. Payloads enabled host profiling, persistence, additional ScreenConnect installs, tunneling, security-control changes, and cryptocurrency mining. ConnectWise has not confirmed a technical link between the flaw and this campaign.
- ScreenConnect file transfer flaw affects Cloud and On-Prem; CVE and fix due within the week
- Mitigation: disable TransferFiles per role, no version upgrade required
- Rogue clients spawn WSH processes running 1.vbs-4.vbs for worm-like spread across connected endpoints
- Registry Run key 'WindowsServiceHost' gives persistence; payloads include mining and tunneling
- Huntress: check audit logs for RunFiles/RanFiles tied to guest process; reimage compromised hosts
- ATT&CK
- T1566 PhishingT1547.001 Registry Run Keys / Startup FolderT1059.005 Visual BasicT1572 Protocol TunnelingT1496 Resource Hijacking
- Vendors
- ConnectWiseHuntress
- Products
- ScreenConnect
From the original article
2 min read at helpnetsecurity.com
A file transfer flaw in ScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed. “A CVE identifier and an official fix will be issued within the week,” the company wrote in its September 3 advisory. ScreenConnect is a popular remote support and access solution tailored for IT departments and managed service providers (MSPs).
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.