Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

This threat involves a malware campaign leveraging rogue ScreenConnect installations deployed via social engineering. The attack chain uses four sequential VBScript payloads (1.vbs to 4.vbs) to profile infected systems, detect security products, establish persistence through Windows Registry Run Keys and hidden services, and deploy additional tools such as UltraViewer, cryptocurrency miners (e.g., XMRig), and tunneling utilities. Modified ScreenConnect clients facilitate worm-like propagation by automatically transferring and executing these scripts on newly connected endpoints, enabling lateral movement across unrelated hosts. The campaign employs advanced evasion techniques including AMSI bypass attempts, Windows Defender exclusions, and UAC bypass mechanisms to avoid detection and maintain persistence. Indicators of compromise include specific IP addresses, file hashes, domains, and URLs. There is no vendor advisory or patch available, and no known exploits in the wild have been reported.

The campaign enables unauthorized remote access and control over infected systems through rogue ScreenConnect installations. It facilitates worm-like propagation across networks, increasing the scope of infection. Deployment of cryptocurrency miners can degrade system performance and increase operational costs. The use of tunneling utilities and additional remote management tools may allow attackers to maintain stealthy persistence and lateral movement within networks. Evasion techniques reduce the likelihood of detection by security products, complicating incident response efforts. Overall, the impact includes unauthorized access, resource abuse, and potential further compromise of networked systems.

No official patch or vendor advisory is available for this threat. Mitigation should focus on preventing initial social engineering attacks and unauthorized installation of ScreenConnect clients. Organizations should verify the legitimacy of ScreenConnect installations and monitor for unexpected VBScript executions and persistence mechanisms such as suspicious Windows Registry Run Keys and hidden services. Implementing application whitelisting to block unauthorized scripts and monitoring network traffic for connections to known malicious indicators (IPs, domains, URLs) can help detect and contain infections. Since this campaign abuses legitimate remote management tools, restricting administrative privileges and enforcing multi-factor authentication for remote access tools is recommended. Patch status is not yet confirmed — check vendor advisories for any updates.