Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.
- Social engineering leads to rogue ScreenConnect clients with C2 at 45.13.237.190 and 131.123.40.98
- wscript.exe executes four staged VBScript files for profiling and persistence
- Modified ScreenConnect clients propagate the VBScript chain to connected endpoints, worm-like
- ConnectWise advisory flags file transfer behavior issue; CVE and fix expected within a week
- Defenders urged to check TransferFiles or TransferFilesInSession permissions
- Vendors
- ConnectWiseHuntressMicrosoft
- Organizations
- HuntressConnectWise
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | anondns.net | nnected back to an attacker-controlled domain ( borertors92.anondns[.]net ). While the attack chain here also involved the ScreenCo |
| domain | opik.net | l, this IP address was associated with the domain tele-sync.opik[.]net during the month of August. Figure 3: According to VirusT |
| ipv4 | 131.123.40.98 | eenConnect client, which was configured to communicate with 131.123.40[.]98 on port 8041 . At that point, the rogue ScreenConnect cli |
| ipv4 | 146.59.55.107 | raViewer remote desktop software, which made connections at 146.59.55[.]107 and 45.32.192[.]150 . UltraViewer is yet another RMM util |
| ipv4 | 15.204.185.204 | ddresses, including 131.123.40[.]98 , 45.13.237[.]190 , and 15.204.185[.]204 . Here, the threat actor also established persistence thr |
| ipv4 | 45.13.237.190 | ed to communicate with a command-and-control (C2) server at 45.13.237[.]190 . According to VirusTotal, this IP address was associated |
| ipv4 | 45.32.192.150 | top software, which made connections at 146.59.55[.]107 and 45.32.192[.]150 . UltraViewer is yet another RMM utility that is known to |
| sha256 | 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020 | s. 7a4d7d66502d4260 Malicious ScreenConnect ID 1.vbs SHA256 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020 VBScript file executed through wscript.exe . 2.vbs SHA256 d |
| sha256 | 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66 | 0 VBScript file executed through wscript.exe . 3.vbs SHA256 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66 VBScript file executed through wscript.exe . 4.vbs SHA256 d |
| sha256 | 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260 | 836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260 VBScript file executed through wscript.exe . 3.vbs SHA256 1 |
| sha256 | de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 | 0 VBScript file executed through wscript.exe . 2.vbs SHA256 de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117 |
| sha256 | de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede | 6 VBScript file executed through wscript.exe . 4.vbs SHA256 de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede VBScript file executed through wscript.exe . Trojan:Script/ |
| sha256 | ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de | Defender Detection for 4.vbs WindowsServiceHost.vbs SHA256 ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de VBScript file executed through wscript.exe . WindowsService |
From the original article
11 min read at huntress.comHuntress is tracking a pattern across multiple customer environments where rogue ScreenConnect clients repeatedly spawn the Windows Script Host to execute a series of four VBScript files.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.