Executive Summary
In late August 2026, a series of incidents were identified where modified ScreenConnect clients were used to facilitate a worm-like propagation of malicious VBScripts across unrelated organizations. The attack chain typically begins with social engineering via Microsoft Quick Assist or phishing, leading to the installation of a rogue ScreenConnect client. Once established, the malware profiles the system, evaluates security software, and initiates a multi-stage infection process.
The campaign is highly sophisticated, using a staged loading mechanism to bypass UAC and deliver customized payloads based on the victim's environment. These payloads include the XMRig cryptocurrency miner, wstunnel for C2 communication, and additional RMM tools like UltraViewer. Notably, the modified ScreenConnect clients automate the transfer of malicious scripts to any newly connected hosts, allowing the infection to spread laterally through legitimate remote access infrastructure.
The impact is significant for organizations relying on remote monitoring and management tools. Adversaries can effectively hijack corporate support sessions to gain persistent access, escalate privileges, and exploit system resources for cryptomining. ConnectWise has acknowledged the issue, noting a potential vulnerability in file transfer behaviors and recommending immediate auditing of session permissions.