Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress reports multiple active incidents where social engineering led to installation of modified ScreenConnect clients that launched a staged four-script VBScript loader to profile hosts, fetch and decrypt encrypted payloads, establish persistence via an HKCU Run key, and propagate infection to connected ScreenConnect sessions (worm-like behavior); payloads include privilege-escalation tooling, AMSI/Defender tampering, tunneling (wstunnel), and an XMRig miner. The write-up lists detailed IOCs (file hashes, IPs, domains, registry keys, filenames), describes UAC/AMSI bypass techniques and modified ScreenConnect backdoors, and notes a related high-severity ScreenConnect vulnerability (CVE-2026-84869) with remediation advice (upgrade to 26.6.5 and restrict TransferFiles permissions).