Affected Systems

ConnectWise ScreenConnect clients (all versions). Attackers deploy rogue ScreenConnect instances via phishing, tech support scams, and fake refund forms. Once installed, malicious VBScript chains propagate to newly connected hosts, creating worm-like lateral movement across ScreenConnect sessions.

Exploitation Status

Active exploitation confirmed. Huntress observed three unrelated incidents in August 2026 using diverse initial access methods (Quick Assist scams, phishing MSI installers, fake Geek Squad forms). Attackers deploy four-stage VBScript chains that profile systems, evade detection, and deliver payloads including backdoors, UAC bypass tools, and XMRig cryptocurrency miners.

Business Impact

Organizations using ScreenConnect for remote support face risk of lateral movement and persistent compromise. Infected ScreenConnect clients automatically propagate malware to newly connected hosts, creating worm-like behavior. Payloads include additional ScreenConnect backdoors, privilege escalation tools, tunneling utilities, and cryptominers. Attackers profile security products (CrowdStrike, SentinelOne, Sophos, Cisco AMP, Huntress, Malwarebytes, Symantec) and tailor payloads accordingly. Incidents involve C2 servers at 45.13.237[.]190, 131.123.40[.]98:8041, and borertors92.anondns[.]net. Re-imaging affected hosts is recommended due to attack complexity.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all ScreenConnect installations for unauthorized clients connecting to non-corporate servers (check for C2 IPs: 45.13.237[.]190, 131.123.40[.]98:8041, borertors92.anondns[.]net)
  • Hunt for persistence mechanisms: Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost pointing to WindowsServiceHost.vbs in AppData; files in C:\Users\Public\Libraries\Default\Lib\Lib1; and %TEMP% artifacts (1.vbs, 2.vbs, 3.vbs, 4.vbs, value.txt, map.txt, out.enc, runner.ps1)
  • Monitor for repeated wscript.exe or cscript.exe spawns from ScreenConnect processes, especially executing numbered VBS files (1.vbs through 4.vbs)
  • Block or alert on unauthorized RMM tools (UltraViewer, rogue ScreenConnect clients) and review ConnectWise advisory for file transfer behavior mitigations
  • Re-image confirmed compromised hosts from known-good media per Huntress recommendation; credential rotation required for any accounts accessed from infected systems