ScreenConnect Weaponized: Self-Propagating Malware Spreads via File Transfer

On September 3, 2026, Huntress disclosed an attack campaign that transforms ConnectWise ScreenConnect from a remote support tool into an automatic propagation vector. Modified clients, initially distributed through social engineering, exploit the virtual file transfer function to replicate onto every new endpoint that connects to the session, generating worm-like spread that requires no further human interaction after the first compromise.

How the 4-Stage Infection Chain Works

The attack mechanics documented by Huntress unfold across four VBScript files executed in sequence. The first, 1.vbs, profiles the target machine: it checks whether ScreenConnect is already installed, measures available RAM, and detects specific EDR products including Huntress itself, Cisco AMP, CrowdStrike, SentinelOne, Sophos, and Malwarebytes. This information is encoded into a three-bit state value that determines which payload will be retrieved next.

The second stage, 2.vbs, connects to Dropbox to download a configuration file obfuscated with Base64 and XOR. Decoding produces a map associating each state value with an encrypted URL and the corresponding AES key for payload retrieval. The third script, 3.vbs, uses this map to download the appropriate encrypted archive and save it as out.enc in the temporary directory.

The fourth and final file, 4.vbs, writes and launches runner.ps1 with execution-policy bypass. The PowerShell script decrypts out.enc using AES-CBC, extracts the ZIP contents, and executes PyTorchFix.ps1, completing deployment of the final payload on the compromised machine.

Persistence and the Three Documented Outcomes

The VBScript chain establishes persistence through a Run Key registry entry named WindowsServiceHost, pointing to WindowsServiceHost.vbs in the user's AppData folder. This mechanism ensures automatic restart of the malware chain at every session logon.

Huntress cataloged three distinct final payload outcomes, selected based on the initial profiling. The first is a user-level backdoor within ScreenConnect itself. The second, termed the "access package," includes advanced persistence tools and privilege escalation: GBHackers documents the use of a UAC bypass exploiting ms-settings: protocol handler hijacking and ComputerDefaults.exe to elevate privileges without consent prompts.

The third outcome combines network tunneling and cryptomining components. Researchers identified wstunnel disguised as Themes.exe, XMRig renamed SearchIndex.exe, and the vulnerable WinRing0 driver, used to access hardware directly and maximize mining efficiency. This layering lets attackers choose between covert access, local escalation, or immediate monetization based on the victim profile.

C2 Infrastructure and Indicators of Compromise

Huntress analysis exposed a command-and-control infrastructure distributed across multiple IP addresses and domains. Documented indicators include IPs 45.13.237[.]190, 131.123.40[.]98 on port 8041, 15.204.185[.]204, and the domain borertors92.anondns[.]net. This distribution suggests intentional design to resist single takedowns.

GBHackers published SHA256 hashes of the four VBScript files for threat hunting, with the first stage identified by hash 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020. The availability of granular IOCs allows organizations to verify the chain's presence in their environments even without behavioral detection.

"Perhaps the most interesting part of the attack chain is that it uses modified ScreenConnect clients to propagate the VBScript chain to connected ScreenConnect endpoints, creating worm-like spread across newly connected systems" — Huntress researchers, via HelpNetSecurity

Immediate Mitigations

ConnectWise has made an immediate mitigation available that requires no version update. Administrators must navigate to Administration > Security > Roles, locate technician roles, and explicitly deselect the TransferFiles and TransferFilesInSession permissions. The change must be applied manually to each role; in environments with many technician profiles this creates an exposure window proportional to the thoroughness of the rollout.

Huntress recommends retroactively analyzing ScreenConnect audit logs for RunFiles or RanFiles events with Process: Guest, a pattern associated with automatic execution of files transferred by rogue clients. The recommendation to reimage from known-good media indicates that selective cleanup may not suffice to guarantee complete removal of the chain, given the multiplicity of documented persistence mechanisms.

Why This Pattern Changes RMM Risk

The September 2026 campaign represents a qualitative evolution from documented abuses of remote management tools. Until now, ScreenConnect and its peers have been predominantly exploited as initial access vectors: compromise an endpoint, establish persistence, move laterally with standard techniques. Here the tool itself becomes the lateral movement mechanism, turning every legitimate support session into a potential vector for automatic infection.

The difference is substantial for MSP operators. It is no longer just about protecting the entry point, but about recalibrating the implicit trust granted to the connection channel itself. File transfer, a function designed to reduce resolution times, has been subverted into a propagation pipeline that requires no additional clicks or victim awareness during the spread phase.

Huntress explicitly recommended additional scrutiny for on-premise ScreenConnect installations, suggesting these may present an extended attack surface compared to cloud deployments. The absence of an official fix at time of publication, with a CVE promised but not yet assigned, leaves organizations having to act on manual mitigations without a verifiable patch to deploy automatically.

Frequently Asked Questions

Which ScreenConnect versions are vulnerable?
ConnectWise did not specify particular versions in the September 3 advisory. The vulnerability affects both Cloud and On-Premise deployments, with no further granularity declared.

Is it necessary to completely disable ScreenConnect?
The source does not recommend uninstallation. The documented mitigation consists of selectively disabling file transfer permissions at the role level.

Is the official fix available?
No. ConnectWise promised a CVE identifier and fix "within the week" from September 3, 2026, but as of the available sources neither the identifier nor the patch had been released.

Sources

• https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/
• https://www.hendryadrian.com/attackers-spread-malware-through-screenconnect-file-transfers/
• https://www.archynewsy.com/hackers-weaponize-screenconnect-to-spread-worm-like-malware/
• https://gbhackers.com/rogue-screenconnect-clients/
• https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/
• https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/
• https://www.helpnetsecurity.com/2025/05/06/social-engineering-human-behavior/
• https://helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/
• https://www.connectwise.com/company/trust/advisories

Information verified against cited sources and current as of publication.

Sources