Rogue ScreenConnect Worm Campaign and Vulnerability Synthesis

In late 2026, threat actors launched a sophisticated worm-like campaign utilizing modified ConnectWise ScreenConnect clients to propagate malicious payloads across unrelated endpoints. The attack typically begins with social engineering, often involving tools like Quick Assist to gain initial access, followed by the deployment of rogue ScreenConnect instances. These modified clients automatically transfer and execute a four-stage VBScript chain (1.vbs to 4.vbs) to newly connected hosts, enabling rapid lateral spread and persistence through User Run Keys.

Simultaneously, ConnectWise has issued advisories for multiple vulnerabilities, including a new unpatched flaw affecting file transfer behavior in both cloud and on-premise deployments. This follows a history of exploitation by actors like the Kimsuky North Korean APT and ransomware groups using previously disclosed flaws such as CVE-2024-1709 (ViewState code injection) and CVE-2026-3564. The multi-stage payloads observed in the recent campaign include reconnaissance, EDR evasion, UAC bypass, and the installation of secondary RMM tools like UltraViewer or XMRig miners.

The impact is significant for Managed Service Providers (MSPs) and IT departments who rely on ScreenConnect for remote administration. The worm-like nature of the current activity means a single compromised host can potentially infect every client it connects to, leading to widespread credential theft and intelligence collection. Urgent mitigation, including disabling file transfer permissions and patching on-premise instances, is required to protect organizational infrastructure.