Worm-like Campaign Leveraging Modified ScreenConnect Clients

Since late August 2026, threat actors have been executing a worm-like campaign involving rogue, backdoored ScreenConnect client instances. The attack typically begins with social engineering, where victims are tricked into installing malicious software under the guise of technical support. Once the rogue ScreenConnect instance is active, it immediately initiates a multi-stage execution chain using Windows Script Host to launch VBScript files from the ScreenConnect temporary directory.

The malicious activity includes system reconnaissance, payload staging, and the execution of PowerShell scripts for UAC bypass and persistent concealment. Crucially, the malware is designed to propagate by continuously monitoring for new host connections and infecting them with the same four-stage VBScript chain. ConnectWise has acknowledged an issue affecting file transfer behavior in ScreenConnect and is working on a fix; they currently advise administrators to disable file transfer functionality to mitigate the risk of unauthorized payload delivery.

Attack Chain

1. Initial access is gained via social engineering (e.g., tech support impersonation) leading the victim to install a rogue or backdoored ScreenConnect client.
2. The rogue ScreenConnect client executes four VBScript files directly from its temporary directory using wscript.exe.
3. The VBScript files perform local system reconnaissance and stage secondary payloads.
4. The malware establishes persistence by creating a User Run Key registry entry pointing to a malicious VBScript file.
5. A PowerShell script is executed to perform UAC bypass and finalize the installation of a concealed ScreenConnect client.
6. The concealed ScreenConnect client continuously monitors for new remote host connections.
7. Upon identifying new host connections, the client propagates the four-stage VBScript chain to the new endpoint, enabling worm-like lateral movement.

Impact

The campaign facilitates unauthorized access, persistent surveillance, and potential lateral movement across organizations using ConnectWise ScreenConnect. By leveraging existing remote support infrastructure to spread malicious payloads, attackers can compromise multiple endpoints within a network simultaneously. If the attack succeeds, the adversary gains full remote control over the affected machines, facilitating data exfiltration, further reconnaissance, or the deployment of additional malicious tools.

Recommendation

Prioritize the following actions to protect your environment:

• Immediately disable the file transfer functionality in all on-premises and cloud-based ScreenConnect instances as recommended by ConnectWise.
• Implement strict endpoint monitoring for wscript.exe spawned from ScreenConnect-related directories.
• Audit all user-level Run Key registry entries for suspicious scripts or unrecognized binaries.
• Monitor for unauthorized ScreenConnect client installations that lack proper management approval.
• Review network logs for unusual outbound connections originating from ScreenConnect processes.