Full Report
Huntress is tracking a pattern across multiple customer environments where rogue ScreenConnect clients repeatedly spawn the Windows Script Host to execute a series of four VBScript files.
Analysis Summary
# Incident Report: Worm-Like Exploitation of ScreenConnect (CVE-2026-84869)
## Executive Summary
Huntress identified a coordinated campaign utilizing rogue ScreenConnect installations to deploy malicious VBScripts across multiple unrelated organizations. The attack leverages a critical client-side vulnerability (CVE-2026-84869) that allows unauthorized file transfers and execution during active sessions. The infection exhibits worm-like behavior, where compromised hosts automatically propagate the malicious payloads to newly connected endpoints.
## Incident Details
- **Discovery Date:** Late August 2026
- **Incident Date:** Ongoing (Confirmed spike August – September 2026)
- **Affected Organization:** Multiple unrelated Huntress customers
- **Sector:** Cross-sector (including Healthcare and Managed Service Providers)
- **Geography:** Global / North America
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026
- **Vector:** Exploitation of CVE-2026-84869 in ScreenConnect.
- **Details:** Attackers exploited a flaw in ScreenConnect’s Client Support and Access sessions where file-transfer actions were permitted without host authorization or confirmation.
### Lateral Movement
- **Mechanism:** Worm-like propagation. Previously infected ScreenConnect clients automatically pushed and executed payloads onto other endpoints participating in the same ScreenConnect environment or sessions.
### Data Exfiltration/Impact
- **Details:** The primary impact was the unauthorized installation of persistent backdoors and additional RMM tools (e.g., UltraViewer), providing attackers with continuous remote access to the environment.
### Detection & Response
- **Discovery:** Huntress SOC detected anomalous process execution where `ScreenConnect.Client.exe` spawned `wscript.exe`.
- **Response Actions:** Huntress issued critical incident reports, notified ConnectWise, and monitored for behavioral anomalies. ConnectWise released a security update (v26.6.5) on September 8, 2026.
## Attack Methodology
- **Initial Access:** Exploitation of unauthorized file transfer vulnerability (CVE-2026-84869).
- **Persistence:** Implementation of a `WindowsServiceHost` User Run Key in the registry pointing to `WindowsServiceHost.vbs` in the `AppData` directory.
- **Privilege Escalation:** Use of elevated execution actions during the file transfer process.
- **Defense Evasion:** Use of legitimate RMM tools (ScreenConnect, UltraViewer) to mask malicious traffic.
- **Discovery:** Identification of connected ScreenConnect endpoints for automated propagation.
- **Lateral Movement:** Automated transfer of VBScripts (`1.vbs` through `4.vbs`) to new clients.
- **Impact:** Full remote system control and potential for further malware deployment (e.g., ransomware).
## Impact Assessment
- **Financial:** Undisclosed; costs associated with incident response and remediation.
- **Data Breach:** Potential for full data access via RMM; specific exfiltration volumes not confirmed.
- **Operational:** High; unauthorized RMM installations bypass standard security controls and create persistent backdoors.
- **Reputational:** Impact to ScreenConnect/ConnectWise regarding the trust of remote management software.
## Indicators of Compromise
- **File Indicators:**
- `1.vbs`, `2.vbs`, `3.vbs`, `4.vbs`
- `WindowsServiceHost.vbs` (located in `%AppData%`)
- **Behavioral Indicators:**
- `wscript.exe` spawned by `ScreenConnect.Client.exe`
- Registry Key: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost`
- Audit Logs: `RunFiles` or `RanFiles` entries initiated by `Process: Guest`
## Response Actions
- **Containment:** Organizations advised to disable `TransferFiles` or `TransferFilesInSession` permissions in ScreenConnect settings immediately.
- **Eradication:** Removal of rogue VBScripts and deletion of unauthorized registry Run keys. Identification and removal of unauthorized RMM software like UltraViewer.
- **Recovery:** Upgrading ScreenConnect clients to version **26.6.5** or higher.
## Lessons Learned
- **Key Takeaway:** Vulnerabilities in RMM tools are highly attractive to attackers as they provide "living off the land" access with inherent administrative privileges.
- **Improvement:** Automated monitoring for child processes of known RMM tools is essential to catch exploitation of authorized software.
## Recommendations
- **Patch Management:** Immediately update all ScreenConnect installations to **v26.6.5**.
- **Hardening:** Review RMM configurations to ensure "Guest" users cannot initiate file transfers without explicit host approval.
- **Monitoring:** Implement EDR rules to alert on `wscript.exe` or `cscript.exe` executions originating from remote management applications.