Cybersecurity firm Huntress has uncovered a worm-like attack campaign using modified ScreenConnect clients to propagate malicious payloads across networks. The attackers leverage social engineering to gain initial access and then move laterally to infect other endpoints.

  • Attackers are using compromised ScreenConnect instances to spread malware.
  • The campaign utilizes social engineering and Windows Quick Assist to gain control.
  • ConnectWise recommends disabling file transfer functionality as a temporary mitigation.

A sophisticated cyberattack campaign is currently underway, utilizing modified ScreenConnect clients to spread malicious payloads across organizational networks. The cybersecurity firm Huntress has issued a warning regarding this 'worm-like' behavior, where the malware actively seeks out and infects other connected instances.

Attack Vector and Execution Chain

The campaign, which began in late August, primarily relies on social engineering to initiate the infection. In one documented instance, a threat actor posing as technical support manipulated a victim into executing the Windows-built-in Quick Assist tool. This allowed the attacker to gain full remote control of the victim's machine.

Read Also:Malicious Virtualizor Updates Delivered via Sophisticated BGP Hijacking Attack

Once access is established, the rogue ScreenConnect instances spawn multiple Windows Script Host (wscript.exe) processes. These processes deploy a chain of four VBScript files designed to perform system reconnaissance, stage additional payloads, and execute a final PowerShell script. This script is specifically engineered to bypass User Account Control (UAC) and conceal the presence of the malicious ScreenConnect client.

Why This Matters

BozokMedia analysis shows that the primary danger of this campaign lies in its lateral movement capabilities. Unlike standard malware that targets a single machine, this worm-like mechanism allows the infection to propagate automatically to any other ScreenConnect endpoint within the same network environment, significantly increasing the blast radius of the attack.

The ability of these rogue clients to autonomously hunt for new host connections transforms a single breach into a network-wide crisis.

To ensure long-term access, attackers have been observed creating User Run Keys for persistence and even installing UltraViewer, another remote desktop software, to maintain control even if the primary entry point is closed.

Historical Background: The Vulnerability of Remote Access Tools

Remote Access Software (RAS) has long been a double-edged sword for IT departments. While essential for modern remote work, tools like ScreenConnect, TeamViewer, and AnyDesk provide high-level privileges. Historically, vulnerabilities in these tools have been exploited by advanced persistent threat (APT) groups to deploy ransomware and conduct industrial espionage.

Did You Know?: A 'worm' is a type of malware that can replicate itself and spread independently across computer networks without any human interaction.

Frequently Asked Questions

Q1: What immediate action should administrators take?
A: ConnectWise recommends that administrators disable the 'file transfer' functionality within ScreenConnect settings to mitigate the risk until a formal patch is applied.

Q2: Does this affect cloud-based ScreenConnect deployments?
A: Yes, the advisory indicates that the issue affects both cloud-based and on-premises deployments.