Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Summary

Threat actors are abusing ConnectWise ScreenConnect to distribute a four-stage VBScript infection chain across newly connected systems. Initial access relies on social engineering, MSI installers, and fake refund forms to profile hosts and drop payloads including backdoors and cryptocurrency miners.

Key Takeaways

1. Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems.
2. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form lure, to activate a four-stage VBScript chain that leads to rogue ScreenConnect installations.
3. In response to the findings, ConnectWise has issued an advisory, stating it has identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions.

Statement Breakdown

• Claimed Facts: 85% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 0% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies directly on detailed technical findings published by cybersecurity firm Huntress. It incorporates specific indicators of compromise, file execution flows, and an official security advisory from software vendor ConnectWise. The technical details are transparent, verified, and lack sensationalized claims.

Bias assessment: Technical and Security-Focused. The article adheres to a neutral, informative tone focused entirely on threat mechanics, incident response guidance, and technical analysis. It reports observations directly from security researchers without commercial bias or speculative political slant. The coverage balances vendor mitigation instructions alongside researcher insights.

Note: Based on verifiable cybersecurity incident disclosures and vendor remediation advisories.

Credibility flag: High Credibility

Claimed Facts (5)

• States checkable forensic execution details and timestamps recorded by researchers.
• Presents precise system checks and output file naming conventions performed by the script.
• Specifies checkable file paths and execution parameters used in stage four.
• Forensically details process termination steps and persistent staging paths.
• Provides factual scope of affected ScreenConnect deployment architectures.

Opinions (5)

• Provides an analytical characterization classifying the observed activity as worm-like propagation.
• Reflects professional incident response guidance and remediation advice.
• Expresses an investigative assessment about the probable delivery method without direct confirmation.
• Evaluates investigative uncertainty resulting from taken-down infrastructure.
• Represents vendor advice outlining best practices prior to patch deployment.

Claims (5)

• Describes deceptive search results delivering malware under the guise of legitimate administrative forms.
• Relies on fraudulent tech-support claims used by threat actors to manipulate victims.
• Details malicious multi-stage execution paths that deploy stealthy backdoors and mining utilities.
• Documents malicious subversion of Windows security mechanisms to install unauthorized software.
• Outlines stealthy backdooring mechanics designed to subvert administrative remote sessions.

Key Sources

• Huntress — Cybersecurity Detection and Response Firm
• ConnectWise — Software Vendor and Developer of ScreenConnect
• The Hacker News — Cybersecurity News Outlet