Rogue ScreenConnect Clients Spread Worm-Like Malware Across Connected Windows Systems

A malicious ScreenConnect campaign in which rogue remote-access clients do more than provide attackers with hands-on control: modified clients can automatically push a multi-stage VBScript malware chain to newly connected Windows endpoints.

Once deployed, the clients repeatedly spawned wscript.exe to execute four scripts 1.vbs, 2.vbs, 3.vbs, and 4.vbs from ScreenConnect-related temporary locations.

The behavior is highly abnormal for a legitimate ScreenConnect deployment and provides a clear endpoint hunting opportunity.

Huntress linked the activity to several initial-access scenarios, including fake Quick Assist support interactions, phishing-delivered ScreenConnect.ClientSetup.msi installers, and a fraudulent Geek Squad refund search that steered a victim into launching a rogue ScreenConnect.Client.exe.

In one case, the client connected to 45.13.237[.]190; other observed infrastructure included 131.123.40[.]98:8041, 15.204.185[.]204, and borertors92.anondns[.]net.

The presence of additional remote monitoring and management tools, including UltraViewer, on affected endpoints suggests operators are layering legitimate remote-access software to retain access and complicate response.

The VBScript chain profiles the compromised host before selecting and decrypting a payload tailored to that environment.

1.vbs creates a three-bit state value in %TEMP%value.txt, checking for existing ScreenConnect installations, endpoint-security products, and available RAM.

It aborts execution if it identifies a pre-existing ScreenConnect client, while the memory check appears intended to avoid low-resource analysis virtual machines.

The script searches for services associated with Huntress, Cisco AMP, CrowdStrike, SentinelOne, Sophos, Malwarebytes, and other security products.

Systems protected only by Microsoft Defender may receive a different payload route than systems with third-party endpoint detection and response tooling.

Next, 2.vbs downloads a Dropbox-hosted, Base64-encoded and XOR-obfuscated configuration file, saving the decoded result as %TEMP%map.txt.

The file maps state values to encrypted payload URLs and AES keys. 3.vbs reads that configuration, retrieves the appropriate encrypted archive, and stores it as out.enc.

Huntress identified three distinct outcomes: a user-level ScreenConnect backdoor, an access package with persistence and privilege-escalation tooling, or a combined package containing tunneling and cryptocurrency-mining components.

Finally, 4.vbs writes and launches %TEMP%runner.ps1 with an execution-policy bypass.

The PowerShell loader decrypts out.enc using AES-CBC, extracts a ZIP archive to the user profile, runs PyTorchFix.ps1, terminates script-host processes, and removes staging artifacts.

Huntress Researchers said that, the incidents, detected across unrelated organizations in late August, began with social-engineering lures that convinced users to install attacker-controlled ConnectWise ScreenConnect clients.

A recurring persistence indicator is the WindowsServiceHost user Run key, which points to WindowsServiceHost.vbs inside the victim’s AppData directory. Investigators also observed a related WindowsServiceHost.bat file in at least one incident.

Rogue ScreenConnect Clients

The most significant finding is embedded in modified ScreenConnect clients recovered by Huntress. For the access-oriented payload branch, the malware copies 1.vbs through 4.vbs to C:UsersPublicLibrariesDefaultLibLib1.

The trojanized client monitors ScreenConnect’s host-session collection, identifies newly connected hosts, transfers the four files through ScreenConnect’s virtual file-transfer mechanism, and instructs the destination to run them.

In effect, a newly connected system can receive the same staged loader merely by connecting to the compromised ScreenConnect client.

The implant tracks connection IDs to avoid repeatedly targeting an active session, but removes those identifiers after disconnection allowing another infection attempt if the host reconnects.

This shifts ScreenConnect from an initial-access tool into a propagation channel across connected Windows systems.

The recovered access package reportedly includes a UAC-bypass mechanism using a hijacked ms-settings: protocol handler and ComputerDefaults.exe.

Its elevated PowerShell code attempts to disable AMSI scanning, add C:Users to Microsoft Defender exclusions, change power settings, install a concealed ScreenConnect client, remove its uninstall entry, and restrict access to its Windows service.

A separate branch can suppress Defender reporting, notifications, and Hypervisor-Protected Code Integrity.

Huntress also identified wstunnel, masquerading as Themes.exe, and an XMRig cryptominer renamed SearchIndex.exe.

The package includes the vulnerable WinRing0 driver, a component frequently abused to facilitate low-level system access.

Similar ScreenConnect campaigns have repeatedly used signed or legitimate remote-management software as a vehicle for malware delivery and persistent access.

Defenders should immediately investigate ScreenConnect audit-log entries where RunFiles or RanFiles shows 1.vbs, 2.vbs, 3.vbs, or 4.vbs executed by Process: Guest.

Security teams should also hunt for ScreenConnect.WindowsClient.exe spawning wscript.exe, the WindowsServiceHost Run key, WindowsServiceHost.vbs under user AppData paths, and suspicious ScreenConnect clients communicating with unapproved external infrastructure.

Organizations should inventory approved remote-management tools, remove unauthorized ScreenConnect and UltraViewer installations, isolate impacted hosts, preserve relevant client binaries and ScreenConnect logs, and rotate credentials used from affected endpoints.

Huntress said it is monitoring the activity and is communicating with ConnectWise as the investigation continues.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.