Huntress Details Worm-Like Campaign Spreading Malicious Scripts Through ScreenConnect
Summary
Huntress traced a campaign using rogue ScreenConnect clients to run staged VBScript and PowerShell payloads, persist on Windows hosts, and spread scripts to newly connected endpoints. ConnectWise fixed a related file-transfer vulnerability in ScreenConnect 26.6.5.
Key points
- Huntress observed rogue ScreenConnect clients on unrelated organizations’ endpoints repeatedly launching wscript.exe to run four VBScript files.
- The activity followed social engineering, including tech-support scams and phishing, and used persistence through a WindowsServiceHost registry Run key.
- The scripts profiled hosts, fetched and decrypted staged payloads, and could install remote-access tools, tunneling utilities, and a cryptocurrency miner.
- Modified ScreenConnect clients could transfer and run the scripts on newly connected Host systems, creating worm-like spread.
- Huntress recommends scrutinizing ScreenConnect audit logs for suspicious RunFiles or RanFiles activity and reimaging affected hosts from known-good media.
- ConnectWise said a file-transfer authorization flaw affected ScreenConnect versions before 26.6.5; the company recommends upgrading to 26.6.5.
Article Details
- Attack Vectors
- Social engineering and phishing led victims to install rogue ScreenConnect clients; one incident began with a tech-support scam using Quick Assist.
- Modified ScreenConnect clients propagated and executed four VBScript files on newly connected ScreenConnect Host endpoints.
- ScreenConnect file-transfer handling could transfer and execute files during an active remote session without proper Host authorization or confirmation, according to ConnectWise's advisory.
- The attack chain used wscript.exe and PowerShell to stage payloads, establish persistence, evade defenses, install additional remote-access software, and deploy tunneling and cryptocurrency-mining payloads.
- Defensive Notes
- Upgrade ScreenConnect to version 26.6.5; ConnectWise stated that earlier versions are impacted and ScreenConnect servers are not impacted.
- For potentially impacted organizations awaiting the fix, ConnectWise recommended checking TransferFiles permissions, or TransferFilesInSession in legacy versions, and disabling the option if enabled.
- Treat ScreenConnect audit-log RunFiles or RanFiles entries showing 1.vbs through 4.vbs executed from Process: Guest as suspicious; also investigate execution of Windows Script Host or PowerShell scripts.
- Huntress recommended reimaging affected hosts from known-good media or performing a clean operating-system installation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | borertors92[.]anondns[.]net | Attacker-controlled domain contacted by a rogue ScreenConnect client. |
| DOMAIN | homehub[.]opik[.]net | Tunneling endpoint used by the masqueraded wstunnel payload. |
| DOMAIN | tele-sync[.]opik[.]net | Domain associated by VirusTotal with the C2 IP used by a rogue ScreenConnect client. |
| IPV4 | 131[.]123[.]40[.]98 | Remote infrastructure contacted by a rogue ScreenConnect client. |
| IPV4 | 146[.]59[.]55[.]107 | Remote infrastructure contacted by installed UltraViewer in an affected incident. |
| IPV4 | 15[.]204[.]185[.]204 | Remote IP address observed in network telemetry for the malicious ScreenConnect activity. |
| IPV4 | 45[.]13[.]237[.]190 | C2 server used by a rogue ScreenConnect client. |
| IPV4 | 45[.]32[.]192[.]150 | Remote infrastructure contacted by installed UltraViewer in an affected incident. |
| SHA256 | 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020 | SHA-256 hash of the malicious 1.vbs script. |
| SHA256 | 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66 | SHA-256 hash of the malicious 3.vbs script. |
| SHA256 | 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260 | Additional SHA-256 hash listed for the malicious 2.vbs script. |
| SHA256 | de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 | SHA-256 hash of a malicious 2.vbs script. |
| SHA256 | de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede | SHA-256 hash of the malicious 4.vbs script. |
| SHA256 | ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de | SHA-256 hash of WindowsServiceHost.vbs, used for persistence. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationPayload data was Base64-encoded, XOR-transformed, and AES-encrypted; the scripts decoded and decrypted it before use.T1055 · Process InjectionThe article describes an attempted AMSI bypass by setting AmsiUtils.amsiInitFailed to true.T1059.001 · PowerShellThe chain created and invoked PowerShell scripts, including runner.ps1 and PyTorchFix.ps1.T1059.005 · Visual Basicwscript.exe executed the four VBScript stages, 1.vbs through 4.vbs.T1090 · ProxyThe wstunnel payload tunneled traffic to homehub.opik[.]net:443.T1105 · Ingress Tool TransferThe VBScript stages downloaded map and encrypted payload files from Dropbox.T1219 · Remote Access ToolsRogue ScreenConnect clients and UltraViewer were installed or abused for remote access.T1496 · Resource HijackingThe 011 payload branch ran an XMRig cryptocurrency miner renamed as SearchIndex.exe.T1547.001 · Registry Run Keys / Startup FolderA WindowsServiceHost User Run Key pointed to WindowsServiceHost.vbs for persistence.T1548.002 · Bypass User Account ControlThe access package used a hijacked ms-settings: protocol handler and ComputerDefaults.exe for a UAC bypass.T1562.001 · Disable or Modify ToolsThe payload attempted to weaken defenses by adding C:\Users as a Microsoft Defender exclusion, disabling Defender reporting and notifications, and bypassing AMSI.T1566 · PhishingThe article reports phishing and social engineering as initial routes to victims installing rogue ScreenConnect clients.
CVE
People
Aaron DealAcknowledged for contributions to the investigation and writeup.Andrew BrandtListed as an author of the Huntress investigation.Ben NahorneyAcknowledged for contributions to the investigation and writeup.Jamie LevyAcknowledged for contributions to the investigation and writeup.John HammondListed as an author of the Huntress investigation.Lindsey O'Donnell-WelchListed as an author of the Huntress investigation.Marc LeanAcknowledged for contributions to the investigation and writeup.Susannah MattAcknowledged for contributions to the investigation and writeup.
Malware
Vendors
Products
Dropboxthe presence of this value.txt file, and if it does not contain the word abort, it downloads a file from Dropbox. It then decodes the file's content from base64 encoding and performs an XOR on the data, which it writesMicrosoft DefenderAs seen in Figure 4, Microsoft Defender detected and quarantined one of these scripts (4.vbs). However, the attacker created a User Run Key (WindowsServiceHost) for persistence that pointed to a VBScript file in theMicrosoft Windowsobserved an unexpected process execution: as seen in Figure 1, the clients were spawning repeated Windows Script Host (wscript.exe) child processes, which was flagged as abnormal behavior. Quick AssistAugust 20 incident, Huntress detected a social engineering attack, which started with a user executing Quick Assist, a built-in Windows remote support tool that's frequently abused by threat actors in well-documentedScreenConnectHomeBlogRogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like ActivityUltraViewerHuntress also observed other remote monitoring and management (RMM) tools, including UltraViewer, on some impacted hosts.