Hackers Weaponize ScreenConnect for Worm-Like Malware Propagation
Attackers are exploiting legitimate ScreenConnect installations to spread malware in a worm-like fashion across Windows systems, leveraging social engineering and the tool's file-transfer capabilities.
Cybercriminals are increasingly turning legitimate remote-support software into a vector for propagating malware across Windows networks. The latest tactic involves exploiting ScreenConnect, a popular remote access tool, to spread malicious code in a worm-like manner. This approach bypasses the need for individual lures for each victim, instead relying on an initial infection to spread laterally through established remote connections.
The campaign typically begins with social engineering tactics, such as fake technical support interactions, phishing emails, or fraudulent refund searches. Victims are tricked into granting remote access or running a malicious installer, which then allows attackers to deploy an unauthorized ScreenConnect client on their system. This method capitalizes on user trust in familiar support workflows, turning a legitimate administration tool into a potent delivery channel once an attacker gains control of its client.
Researchers from Huntress identified this pattern across multiple unrelated organizations during late August, suggesting a coordinated operation rather than isolated incidents. The danger extends beyond the initial compromised machine. The malware is designed to profile the host, attempt to evade systems with specific security tools, establish persistence after reboots, and deliver additional payloads.
In its more advanced configurations, the operation can escalate privileges, weaken Windows security defenses, tunnel network traffic, and deploy cryptocurrency miners. The stealthy nature of these attacks means they can blend into routine administrative activities, making them difficult to detect until unusual script executions are identified on endpoints.
The altered ScreenConnect clients repeatedly leverage Windows Script Host to execute a multi-stage script chain. The initial stages focus on reconnaissance and preparing encrypted payloads, while later stages select and deploy the final malicious tools based on the system's profile. A particularly concerning aspect is the worm-like propagation mechanism: when a new host session connects, the client uses ScreenConnect's file-transfer feature to deliver staged scripts and mark them for execution on the newly connected machine.
This method effectively transforms ordinary remote connections into an infection route. While the malware tracks connection identifiers to avoid re-sending payloads during an active session, it removes these records upon disconnection. This means that reconnecting the same system can re-initiate the delivery chain, enabling attackers to expand their reach with each new connection.
One variant of the attack installs a concealed remote-access client with elevated privileges, while another deploys tunneling and cryptocurrency mining software. This aligns with a broader trend of attackers abusing remote management tools for hands-on control. While ScreenConnect itself is not malicious, an attacker-controlled installation provides a durable foothold for malicious activities.
To mitigate these threats, organizations are advised to reimage affected hosts from known-good media or perform clean operating system installations. Administrators should meticulously review their on-premises ScreenConnect deployments, scrutinizing server audit logs for suspicious remote file-execution actions originating from guest processes. Security teams must also remain vigilant for unusual Windows Script Host or PowerShell activity associated with ScreenConnect sessions, as filenames used by attackers may change.