Cybersecurity researchers at Huntress have identified worm-like activity abusing ConnectWise ScreenConnect to distribute malicious VBScript payloads to newly connected systems. Three unrelated incidents were discovered, each using different initial access methods: a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake application. The attack chain consists of four stages delivered via Visual Basic Script. Once a rogue ScreenConnect client is established, it spreads the malicious payload to other hosts that connect to the compromised instance. This lateral movement capability makes the threat particularly dangerous in enterprise environments where ScreenConnect is widely used for remote management. The activity highlights the ongoing abuse of legitimate remote access tools by threat actors.
Worm-like activity abuses ConnectWise ScreenConnect to distribute a malicious four-stage VBScript (VBS) payload to newly connected systems. Three unrelated incidents were observed in August 2026, each using different initial access methods: (1) Quick Assist tech-support scam, (2) phishing-delivered MSI installer (ScreenConnect.ClientSetup.msi), and (3) fake Geek Squad refund form lure. Once rogue ScreenConnect clients are installed, they spawn 'wscript.exe' to execute four VBScripts (1.vbs, 2.vbs, 3.vbs, 4.vbs) in sequence. Stage 1 (1.vbs): Profiles the host, checks RAM (>5 GB), verifies ScreenConnect installation, enumerates security products (Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, Symantec Endpoint Protection), and writes a three-bit state value to %TEMP%\value.txt. Stage 2 (2.vbs): Waits for value.txt, checks for 'abort', then downloads and decodes a file from Dropbox, writing contents to %TEMP%\map.txt. Stage 3 (3.vbs): Reads map.txt and downloads a payload from a Dropbox URL specified therein based on state values, writing to %TEMP%\out.enc. Stage 4 (4.vbs): Waits for out.enc, launches %TEMP%\runner.ps1 to decrypt contents, writes to %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip, and executes a second-stage PowerShell script (PyTorchFix.ps1). Three payload branches exist based on state value: '000'/'001' deploy a user-level ScreenConnect backdoor; '010' deploys UAC bypass and persistence tooling; '011' deploys tunneling utilities and XMRig cryptocurrency miner (also disables Microsoft Defender reporting and Windows memory integrity). The runner.ps1 terminates all wscript.exe/cscript.exe processes and deletes the staging directory. For state values 010 or 011, the four VBS files are copied to C:\Users\Public\Libraries\Default\Lib\Lib1, creating worm-like propagation: each newly connected ScreenConnect host receives and executes the same chain. The backdoored client tracks ConnectionIDs to avoid repeat infections per session but removes identifiers upon disconnect, allowing reinfection on reconnection. A persistence mechanism via WindowsServiceHost.vbs in AppData is set via a Run Key. Other RMM tools like UltraViewer were also observed on affected hosts. ConnectWise identified the root cause as an issue in file transfer behavior in ScreenConnect Remote Access Support and Access sessions, affecting both Cloud and On-Premise deployments.
1. Re-image affected hosts from known-good media or perform a clean OS install as recommended by Huntress SOC due to the complexity and extent of the attack chain. 2. Mitigate the ScreenConnect file transfer vulnerability by disabling TransferFiles permissions: log into the ScreenConnect Administration page, navigate to Administration > Security > Roles, edit each role assigned to users, review each session group's Scoped Permissions, deselect the TransferFiles permission (or TransferFIlesInSession for legacy versions), save changes, and repeat for all defined roles. 3. Monitor for and block connections to known malicious IPs and domains: 45.13.237[.]190, tele-sync.opik[.]net, 131.123.40[.]98 (port 8041), borertors92.anondns[.]net. 4. Monitor for suspicious wscript.exe or cscript.exe processes spawned by ScreenConnect. 5. Monitor for presence of malicious files: 1.vbs, 2.vbs, 3.vbs, 4.vbs, value.txt, map.txt, out.enc, runner.ps1, PyTorchFix.ps1, sys_cache.zip, WindowsServiceHost.vbs in Temp and AppData directories. 6. Monitor for WindowsServiceHost Run Key in user AppData. 7. Check for unauthorized ScreenConnect clients and other unauthorized RMM tools (e.g., UltraViewer). 8. Monitor for XMRig miner activity and unexpected disabling of Microsoft Defender reporting or Windows memory integrity. 9. Review ConnectWise's official advisory at https://www.connectwise.com/company/trust/advisories for patches and updates once available. 10. Audit all ScreenConnect installations for rogue or unauthorized instances.
45.13.237[.]190, tele-sync.opik[.]net, 131.123.40[.]98, borertors92.anondns[.]net, ScreenConnect.ClientSetup.msi, ScreenConnect.Client.exe, 1.vbs, 2.vbs, 3.vbs, 4.vbs, %TEMP%\value.txt, %TEMP%\map.txt, %TEMP%\out.enc, %TEMP%\runner.ps1, %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip, PyTorchFix.ps1, C:\Users\Public\Libraries\Default\Lib\Lib1, WindowsServiceHost.vbs, WindowsServiceHost User Run Key, XMRig cryptocurrency miner
