{"id":2722,"date":"2026-09-07T14:42:05","date_gmt":"2026-09-07T14:42:05","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2722"},"modified":"2026-09-07T14:42:05","modified_gmt":"2026-09-07T14:42:05","slug":"rogue-screenconnect-clients-spread-four-stage-vbscript-chain-to-newly-connected-hosts","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2722","title":{"rendered":"Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Sep 07, 2026<\/span><\/span><span class=\"p-tags\">Malware \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWA_nxvqJuKkqq0ab1I-XR1YtpsM6BadhHDNOIheZmBflLWaQ018JFJsAUBVuyWWTYI4pyT8OQNXhui8Annde3SnOIScH9B0ohMq-OzXLjvPeAXQnz4mAUdEMS_07i7gLaWqPVpHaPvyLJdZQKUTs2MLGhjB9UZ0A83CGcSeDCJFKn7hNjiyf6dbzbHogp\/s1700-nu-rw-lo-l85-e365\/screen.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems.<\/p>\n<p>According to <a href=\"https:\/\/www.huntress.com\/blog\/rogue-screenconnect-installations\" target=\"_blank\">Huntress<\/a>, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form lure, to activate a four-stage VBScript chain that leads to rogue ScreenConnect installations.<\/p>\n<p>However, once the ScreenConnect instances were installed, the cybersecurity company said it observed the clients repeatedly spawning \u00abwscript.exe\u00bb to execute VBScripts named 1.vbs, 2.vbs, 3.vbs, and 4.vbs. The incidents were observed in August 2026.<\/p>\n<p>The details of the three attacks are below &#8211;<\/p>\n<ul>\n<li>A social engineering attack that persuaded a user into executing Quick Assist as part of a tech support scam, after which a rogue ScreenConnect remote access client was deployed to contact a command-and-control (C2) server located at \u00ab45.13.237[.]190\u00bb (\u00abtele-sync.opik[.]net\u00bb). Hosted on the IP address is a RAR archive containing the four VBS files.<\/li>\n<li>An MSI installer (\u00abScreenConnect.ClientSetup.msi\u00bb) likely delivered via a phishing attack that deployed a ScreenConnect client configured to communicate with \u00ab131.123.40[.]98\u00bb on port 8041. The rogue ScreenConnect almost immediately launched the four VBScript files from the ScreenConnect temporary directory.<\/li>\n<li>A search for a Geek Squad refund form led to the deployment of a rogue ScreenConnect client (\u00abScreenConnect.Client.exe\u00bb), which then connected to \u00abborertors92.anondns[.]net.\u00bb The session then uses \u00abwscript.exe\u00bb to execute the four VBS scripts from the Temp folder.<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/trust-world-update-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhYq3TvePXpW0JIC7fXyv7A1W8KQqmb-AZqza2EuPyT0k8Nm5CwHYHISFLKXSKIAyR8JRtqEFQ4zx5jADiAkZKQ08nRWG1jCRV5YAbhKua7WaDdH1L6wsI-xOkoV4brlMfK44UwU-4Q1xqWg0uNN7sZkMCzci4RXYgWMNPHTtuKua7OR4oCbmxE10u0yKnR\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Across these incidents, the attack sequence is said to have followed a four-step process, with each VBScript launching the next and allowing it to progress further &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li><strong>1.vbs<\/strong>, which profiles the host, checks system resources (e.g., if RAM is over 5 GB), verifies if ScreenConnect is installed, enumerates security products, including Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, and Symantec Endpoint Protection, and writes the results of these checks to \u00ab%TEMP%\\value.txt\u00bb in the form a three-bit state variable. For example, the state value \u00ab000\u00bb indicates no existing ScreenConnect installation, the presence of third-party security processes, and no ScreenConnect clients are installed within the Program Files folder.<\/li>\n<li><strong>2.vbs<\/strong>, which waits for the \u00ab%TEMP%\\value.txt\u00bb file and checks for the presence of the word \u00ababort.\u00bb If the word does not exist, it downloads a file from Dropbox, decodes its contents, and writes them to \u00ab%TEMP%\\map.txt.\u00bb While the text file contents are not executed, the exact nature of the payload retrieved is unclear, as the Dropbox URL is no longer online as of September 2, 2026.<\/li>\n<li><strong>3.vbs<\/strong>, which works similarly to 2.vbs by waiting for \u00ab%TEMP%\\map.txt\u00bb and then proceeds to download the relevant file from the Dropbox link specified in the text file based on the state values set by 1.vbs in \u00ab%TEMP%\\value.txt\u00bb and writes it to \u00ab%TEMP%\\out.enc.\u00bb<\/li>\n<li><strong>4.vbs<\/strong>, which waits for the presence of the downloaded \u00ab%TEMP%\\out.enc\u00bb payload and launches a PowerShell script (\u00ab%TEMP%\\runner.ps1\u00bb) to decrypt the contents of \u00ab%TEMP%\\out.enc,\u00bb write them to \u00ab%APPDATA%\\Microsoft\\Windows\\Templates\\Classic\\sys_cache.zip,\u00bb and execute a second-stage PowerShell script (\u00abPyTorchFix.ps1\u00bb).<\/li>\n<\/ul>\n<p>At least three different payloads have been detected based on the state value &#8211;<\/p>\n<ul>\n<li><strong>000<\/strong> and <strong>001<\/strong> lead to a user-level ScreenConnect backdoor<\/li>\n<li><strong>010<\/strong> leads to tooling for privilege escalation via a User Account Control (<a href=\"https:\/\/www.elastic.co\/security-labs\/threat-command\/exploring-windows-uac-bypasses-techniques-and-detection-strategies\" target=\"_blank\">UAC<\/a>) bypass and persistence<\/li>\n<li><strong>011<\/strong> leads to tunneling utilities and a cryptocurrency miner<\/li>\n<\/ul>\n<p>In addition, \u00ab%TEMP%\\runner.ps1\u00bb takes steps to terminate every \u00abwscript.exe\u00bb or \u00abcscript.exe\u00bb process, and deletes the staging directory after the final stage is run. The 4.vbs script also writes the four VBScript files to \u00abC:\\Users\\Public\\Libraries\\Default\\Lib\\Lib1\u00bb if the value in \u00ab%TEMP%\\value.txt\u00bb is set to 010 or 011.<\/p>\n<p>This, in turn, triggers a round of payload deliveries, effectively turning the compromised host into a content-delivery mechanism for the malicious scripts every time the backdoored client observes a new Host connection.<\/p>\n<p>\u00abThis creates a worm-like behavior: propagating infections over new ScreenConnect connections. Connecting to an infected ScreenConnect client can cause the server-side Host system to receive and execute the same four-stage VBScript chain,\u00bb Huntress said. \u00abLater, the client records each ConnectionID to avoid repeatedly targeting the same active session, but then removes that identifier after it disconnects \u2013 allowing a later reconnection to trigger the infection again.\u00bb<\/p>\n<p>\u00abThe incidents share additional indicators, including a WindowsServiceHost User Run Key pointing to WindowsServiceHost.vbs in the user&#8217;s AppData directory,\u00bb Huntress said, adding it observed other remote monitoring and management (RMM) tools, including UltraViewer, on some impacted hosts.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/enterprise-ai-security-a\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhgJrVTpy3T5kJ7VEIro3XfMOmfqDnBU03fYT5CyFWrs2rE9BeQxs835FAS_f1yivzd7mZ7KartftPk4qs8w5Br-WzfYMXruXDQk4FiuXcvSxoA4XH93ipwJJyy2Hbs9jqs-keS9KZhCnQ2YYdv93M51kxJlE862ob-RrrEhP4DEVP3E79zMMPf43e5keoK\/s728-nu-rw-lo-l85-e365\/AI-eBook-d-2.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>On the other hand, the state value branch \u00ab011,\u00bb which translates to: (1) no existing installation of ScreenConnect on the system, (2) Microsoft Defender is the only the endpoint protection program installed on the machine, and (3) no ScreenConnect clients are present, includes payloads to disable Microsoft Defender reporting, turn off Windows memory integrity, and runs an XMRig cryptocurrency miner.<\/p>\n<p>\u00abConsidering the extent and complexity of these attack chains, the Huntress SOC made strong recommendations that these affected hosts be re-imaged from known-good media, or a clean operating system install,\u00bb Huntress said.<\/p>\n<p>In response to the findings, ConnectWise has <a href=\"https:\/\/www.connectwise.com\/company\/trust\/advisories\" target=\"_blank\">issued an advisory<\/a>, stating it has identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions. The issue, it added, impacts both Cloud and On-Premise deployments. <\/p>\n<p>Until a fix is in place, customers are recommended to mitigate the risk by disabling the ability for technicians to transfer files &#8211;<\/p>\n<ul>\n<li>Log into the Administration page of ScreenConnect instance or installation.<\/li>\n<li>Navigate to the Administration &gt; Security &gt; Roles section.<\/li>\n<li>Edit a role that is assigned to users.<\/li>\n<li>Review each session group that has permissions assigned to it.<\/li>\n<li>For each session group, in the Scoped Permissions window, check if the TransferFiles permission (or TransferFIlesInSession for legacy versions) is selected. If it is, deselect it.<\/li>\n<li>Save changes to the role.<\/li>\n<li>Repeat for each role that&#8217;s defined in the instance or installation. <\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Sep 07, 2026Malware \/ Vulnerability Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2723,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[219,669,3067,3328,1047,1261,699,863,262,2147],"class_list":["post-2722","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-chain","tag-clients","tag-connected","tag-fourstage","tag-hosts","tag-newly","tag-rogue","tag-screenconnect","tag-spread","tag-vbscript"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2722"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2722\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2723"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}