Skip to content

Back to the catalog

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
huntress.comwriteup

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress details a campaign in which social-engineering (tech-support scams, Quick Assist, malicious downloads) leads to rogue ScreenConnect installs that deploy a four-stage VBScript loader (1.vbs–4.vbs). The loader profiles the host (checking for EDR products, existing ScreenConnect, RAM size), fetches an AES-encrypted payload via a Dropbox-hosted map file, and drops one of three packages: a user-level backdoor, a persistence/privesc kit, or a tunneling+cryptomining bundle (wstunnel/XMRig plus the vulnerable WinRing0 driver for BYOVD). A backdoored ScreenConnect client then re-pushes the VBScript chain to every newly connected Host session via ScreenConnect's file-transfer API, giving the campaign worm-like self-propagation — which ConnectWise later confirmed stems from CVE-2026-84869, a 9.9 CVSS flaw in unauthorized file-transfer execution, patched in ScreenConnect 26.6.5.

TL;DR Huntress uncovers a worm-like ScreenConnect campaign that abuses a file-transfer flaw (CVE-2026-84869) to self-propagate a VBScript/PowerShell loader dropping backdoors, persistence tooling, or an XMRig cryptominer.
Open original ↗
Document

What it is

Huntress's ongoing writeup (updated 9/8/26) of the rogue-ScreenConnect worm campaign, confirmed by ConnectWise as CVE-2026-84869 (CVSS 9.9). The summary already has the loader chain and packages; what it lacks are the interim mitigation before patching, the detection surface, and the remediation stance — the parts an engineer acts on.

Preconditions / Affected

On-premises and cloud ScreenConnect Client Support/Access sessions prior to 26.6.5 are impacted. ScreenConnect servers are not impacted. The flaw is client-side: file-transfer actions could execute on the Host during an active remote session without Host authorization or confirmation, including via elevated execution. Infection re-triggers on reconnection — the backdoored client records a ConnectionID to avoid re-hitting an active session, but drops that ID on disconnect, so a later reconnect re-infects.

What to do

  • Patch to ScreenConnect 26.6.5.
  • Interim mitigation (ConnectWise, before the fix): check the TransferFiles permission (TransferFilesInSession in legacy versions) and disable it if enabled.
  • Detection — inspect ScreenConnect server audit logs for RunFiles or RanFiles events referencing 1.vbs–4.vbs executed from Process: Guest. Huntress warns filenames may rotate, so treat any Windows Script Host or PowerShell execution from a session as a red flag.
  • Host artifacts: a WindowsServiceHost User Run Key pointing to WindowsServiceHost.vbs in the user's AppData; ScreenConnect.WindowsClient.exe spawning repeated wscript.exe; concealed ScreenConnect client ID 7a4d7d66502d4260 (Uninstall registry entry removed, restrictive service security descriptor); Defender exclusion added for all of C:\Users; Themes.exe (wstunnel), SearchIndex.exe (XMRig), svcdrv64.sys (vulnerable WinRing0 for BYOVD).
  • Remediation: Huntress SOC recommends reimaging from known-good media / clean OS install for affected hosts — not cleanup, given the AMSI bypass, UAC bypass (hijacked ms-settings: handler via ComputerDefaults.exe), and HVCI-disabling in the elevated branches.

Caveats

The Dropbox-hosted map.txt staging URL was offline as of Sept 2, so live payload retrieval may fail — but the propagation loop and local persistence do not depend on it. 4.vbs was caught by Defender in one incident, yet persistence still succeeded via the batch/run-key path, so a single quarantine hit does not mean the host is clean.

CVEs named here

  • CVE-2026-84869

Technologies named here

Techniques named here

  • Social engineering / tech-support scam
  • RMM abuse
  • Worm-like propagation via file-transfer messages
  • Persistence via Registry Run Key
  • Host/environment profiling and anti-analysis
  • Staged encrypted payload delivery
  • AMSI bypass
  • UAC bypass via hijacked protocol handler
  • Defender evasion / exclusion
  • Service/registry concealment
  • Anti-forensic cleanup
  • BYOVD

Threat actors named here

  • Unnamed threat actor behind rogue ScreenConnect campaign
  • XMRig

Related in Threat Intel