Hackers Weaponize ScreenConnect to Spread Worm-Like Malware Across Windows Systems

Severity

Medium

Detail

Huntress researchers have uncovered a campaign weaponizing modified ScreenConnect clients to spread malware laterally across Windows networks. Originating from tech-support scams and phishing lures, attackers trick users into installing rogue remote-support clients.

Once deployed, the modified client automatically packages and pushes staged payloads to newly connected systems using ScreenConnect’s native file-transfer feature, turning trusted remote-access software into an automated, worm-like delivery vector.

How?

The campaign begins with social engineering interactions, including fake technical-support phone calls, Windows Quick Assist lures, phishing emails, and fraudulent search results. Attackers convince victims to grant interactive remote access or run a rogue installer, establishing an unauthorized ScreenConnect client on the endpoint.

Once established on a host, the altered ScreenConnect client repeatedly invokes Windows Script Host (wscript.exe / cscript.exe) to execute a four-stage script chain. The initial stages profile the host system, evaluate installed security tools, and set up encrypted follow-on components while establishing registry-based persistence.

Based on host conditions, the scripts trigger secondary payloads—such as deploying concealed remote-access clients with elevated privileges, setting up network tunnels, or launching cryptocurrency miners.

The primary innovation of this campaign is its automated lateral propagation mechanism. When a new remote host session comes online, the modified client packages the staged script chain and utilizes ScreenConnect’s native file-transfer feature to automatically transmit and execute the payload on the newly connected machine.

The malware tracks session connection identifiers to prevent repeated delivery during an active session; however, because these session records are cleared upon disconnect, reconnecting the same system re-triggers the infection process. This mechanism converts routine remote-support sessions into an automated, worm-like transmission route across connected endpoints.

Conclusion

This campaign shows how attackers exploit trusted remote-management software to propagate across network environments without requiring additional user interaction. Defending against this vector requires restricting unauthorized remote tools and closely auditing management software activity.

To mitigate this risk, security teams should isolate and reimage affected endpoints from clean media. Organizations should audit ScreenConnect server logs for remote file executions initiated by guest processes, monitor Windows Script Host and PowerShell activity spawned by ScreenConnect binaries, and enforce application allowlisting to block unauthorized remote-support software.

Finally, user training should reinforce never sharing remote-access codes or running support tools following unsolicited calls or web pop-ups.

Source

https://cybersecuritynews.com/hackers-weaponize-screenconnect/