Cybersecurity firm Huntress has uncovered a wave of malicious installations of ScreenConnect, a widely used remote-support tool, that spread between machines without any further action from a victim or an attacker, a self-propagating attack chain researchers likened to a computer worm.
In a blog post published this week, Huntress said its Security Operations Center (SOC) had flagged the same unusual pattern of activity across several unrelated customer environments in late August. Investigators later found the incidents were connected by a shared attack chain built around modified, or “rogue,” copies of ScreenConnect, a legitimate remote-access product made by ConnectWise that IT teams and help desks use to support end users remotely.
A familiar scam, an unfamiliar twist
Each incident Huntress examined began with social engineering. In one case, a victim ran Microsoft’s built-in Quick Assist tool after being convinced, likely through a fake tech-support call, that their computer had been compromised, a well-worn tactic in tech-support scams. In another, a user searching online for a Geek Squad refund form was instead led to download and run a bogus ScreenConnect installer.
Once the rogue ScreenConnect client was installed, each infected machine began repeatedly launching the Windows Script Host process to run a sequence of four VBScript files, named simply 1.vbs through 4.vbs. Huntress said this behaviour, along with a matching persistence mechanism disguised as a “WindowsServiceHost” registry entry, appeared consistently across every incident, despite the organisations involved having no obvious connection to one another.
According to Huntress’s analysis, the four scripts work in stages. The first profiles the infected machine, checking whether ScreenConnect is already installed, cataloguing which security products are running, and confirming the system has enough memory to plausibly be a real computer rather than a malware analyst’s virtual machine. Based on that profile, later scripts pull down and decrypt additional payloads, which can include a backdoored ScreenConnect client, tools for privilege escalation and persistence, or a bundle containing tunnelling software and a cryptocurrency miner.
Turning victims into distribution points
The most striking element of the campaign, Huntress said, is how it spreads. Buried inside the backdoored ScreenConnect client is code that watches for new incoming remote-support sessions. When a new connection appears, the infected client automatically packages up the same four VBScript files and pushes them to the newly connected system, triggering the same infection chain there too.
In practice, that means a legitimate support session, a technician or help desk agent remotely connecting to a compromised machine to assist a user, could result in the malware spreading onward to the technician’s own environment, with no additional phishing or social engineering required at that stage. Huntress said the infected client keeps track of which sessions it has already targeted, but drops that record once a session ends, allowing the same host to be reinfected on a later reconnection.
Huntress also observed secondary remote-access tools, including UltraViewer, deployed on some compromised machines, suggesting the attackers were establishing multiple footholds in case one was discovered and removed.
Researchers point to LLM-assisted development
While unpacking the scripts, Huntress researchers noted a comment embedded in one of the VBScript files that appeared to explain, in unusually plain language, how to parse an encryption key out of a configuration file, the kind of explanatory comment researchers said was consistent with code generated with the help of a large language model.
What organisations should do
Given the depth of access the malware can obtain, including attempts to disable Microsoft Defender reporting and bypass User Account Control, Huntress recommended wiping and reimaging any confirmed infected machine from known-clean media rather than cleaning it in place.
The firm urged administrators to scrutinise any on-premises ScreenConnect deployments and to check ScreenConnect server audit logs for RunFiles or RanFiles entries showing scripts executed from a “Guest” process, which it said should be treated as an immediate red flag. Huntress cautioned that the specific filenames associated with the campaign may change over time, and that any unexpected Windows Script Host or PowerShell activity tied to ScreenConnect sessions should be investigated.
Huntress said it is in direct contact with ConnectWise, ScreenConnect’s maker, and continues to monitor the activity. The report includes a full set of indicators of compromise, including file hashes and command-and-control infrastructure, for defenders to check against their own environments.
Remote monitoring and management tools like ScreenConnect have been among the most abused categories of software this year, according to Huntress, which has previously documented social-engineering campaigns using the same class of tool to gain initial access to victim networks. What sets this campaign apart, researchers said, is the addition of automated, worm-like propagation on top of an already common attack vector.
