Full Report
Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake
Analysis Summary
# Tool/Technique: Rogue ScreenConnect Worm-Like VBScript Chain
## Overview
This activity involves the abuse of the **ConnectWise ScreenConnect** remote desktop software to distribute a multi-stage malicious VBScript payload. The attack exhibits worm-like behavior by propagating infections to newly connected hosts through hijacked ScreenConnect sessions, ultimately delivering backdoors, miners, or privilege escalation tools depending on the victim's environment.
## Technical Details
- **Type:** Malware Chain / Propagation Technique
- **Platform:** Windows
- **Capabilities:** System profiling, security software evasion, UAC bypass, persistence, credential/tunneling tool delivery, and cryptocurrency mining.
- **First Seen:** August 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]
- [T1219 - Remote Access Software]
- **[TA0002 - Execution]**
- [T1059.005 - Command and Scripting Interpreter: VBScript]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- **[TA0007 - Discovery]**
- [T1518.001 - Software Discovery: Security Software]
- [T1082 - System Information Discovery]
- **[TA0004 - Privilege Escalation]**
- [T1548.002 - Abuse Elevation Control Mechanism: UAC Bypass]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
## Functionality
### Core Capabilities
- **Environmental Profiling:** The first stage (`1.vbs`) checks for RAM capacity (>5GB), existing ScreenConnect installations, and the presence of specific security products (Cisco AMP, CrowdStrike, Huntress, etc.).
- **Conditional Payload Delivery:** Uses a state variable (e.g., "000", "010") to determine which payload to download from external sources (Dropbox).
- **Stealth and Cleanup:** The final stage (`runner.ps1`) terminates script engine processes (`wscript.exe`/`cscript.exe`) and deletes the temporary staging directory to remove traces of the infection.
### Advanced Features
- **Worm-like Propagation:** If specific conditions are met, the scripts are written to a public library folder, allowing the compromised host to act as a distribution point for any new client that connects via the hijacked ScreenConnect session.
- **Dynamic Decryption:** Uses PowerShell to decrypt downloaded `.enc` files into executable ZIP archives and secondary scripts (`PyTorchFix.ps1`).
## Indicators of Compromise
- **File Names:**
- `1.vbs`, `2.vbs`, `3.vbs`, `4.vbs`
- `ScreenConnect.ClientSetup.msi`
- `runner.ps1`
- `PyTorchFix.ps1`
- `value.txt`, `map.txt`, `out.enc`
- **Network Indicators:**
- `45.13.237[.]190`
- `tele-sync.opik[.]net`
- `131.123.40[.]98`
- `borertors92.anondns[.]net`
- **Behavioral Indicators:**
- `ScreenConnect.Client.exe` repeatedly spawning `wscript.exe`.
- Creation of files in `%TEMP%` and `%APPDATA%\Microsoft\Windows\Templates\Classic\`.
- Writing files to `C:\Users\Public\Libraries\Default\Lib\Lib1`.
## Associated Threat Actors
- Currently unattributed (Activity reported by Huntress involving diverse lures like Quick Assist scams and fake Geek Squad forms).
## Detection Methods
- **Behavioral Detection:** Monitor for ScreenConnect processes (`ScreenConnect.Client.exe`) spawning `wscript.exe` or `powershell.exe`. Monitor for rapid creation and deletion of `.vbs` files in the `%TEMP%` directory.
- **Process Monitoring:** Watch for PowerShell scripts performing decryption of files in non-standard directories like `AppData\Templates`.
- **Network Monitoring:** Alert on connections to known dynamic DNS providers (e.g., `anondns[.]net`) or direct IP connections on port 8041 from remote management tools.
## Mitigation Strategies
- **Application Whitelisting:** Restrict the execution of VBScript (`wscript.exe`) and PowerShell for standard users where not required.
- **Remote Tool Hardening:** Ensure ConnectWise ScreenConnect is updated to the latest version and implement strict access controls/MFA.
- **User Training:** Educate users on "Quick Assist" scams and unsolicited tech support lures.
- **Endpoint Protection:** Ensure EDR solutions are configured to block unauthorized remote access tool installations and monitor for UAC bypass attempts.
## Related Tools/Techniques
- **Living off the Land (LotL):** Abuse of legitimate tools like Quick Assist and ScreenConnect.
- **Social Engineering:** Impersonation of Geek Squad or IT Support.