Rogue ScreenConnect Clients Spread Worm-Like Malware Across Connected Windows Systems

Huntress observed a campaign abusing trojanized ConnectWise ScreenConnect clients to push a four-stage VBScript loader (1.vbs–4.vbs) to newly connected Windows systems, which spawns wscript.exe, profiles hosts, decrypts tailored payloads, and can deliver backdoors, persistence/UAC bypass, tunneling, and an XMRig cryptominer; the malicious clients propagate via ScreenConnect file-transfer and have been distributed through fake support interactions and phishing installers. Defenders are urged to hunt for ScreenConnect spawning wscript.exe, Run key indicators such as WindowsServiceHost, the listed VBS hashes and malicious infrastructure, isolate affected hosts, preserve logs/binaries, and remove unauthorized remote-management tools.