Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
Campaigns starting in late August use social engineering, including Quick Assist abuse, to install rogue ScreenConnect clients that spawn wscript.exe and deploy four VBScript files for reconnaissance, staging, and PowerShell execution. The attackers persist via User Run Keys, attempt UAC bypass, install UltraViewer, and propagate the VBScript chain to other connected ScreenConnect endpoints. ConnectWise published an advisory about a file transfer behavior issue affecting cloud and on-premises ScreenConnect, with a CVE identifier and fix expected within a week; it recommends disabling file transfer meanwhile.
- Rogue ScreenConnect clients spawn repeated wscript.exe processes to run four VBScript files
- PowerShell stage erases evidence, attempts UAC bypass, and installs hidden ScreenConnect client
- Persistence via User Run Keys; UltraViewer remote desktop installed
- Attacks began with tech-support social engineering and Quick Assist abuse
- ConnectWise advisory: disable file transfer until CVE and patch are released
- Vendors
- ConnectWiseHuntress
- Organizations
- ConnectWiseHuntress
From the original article
2 min read at securityweek.com
The attacks rely on backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients. The post Modified ScreenConnect Clients Used in Worm-Like Campaign appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.