Modified ScreenConnect Clients Spread Payloads in Worm-Like Campaign

Summary

Huntress says attackers used social engineering to install rogue ScreenConnect clients that ran VBScript and PowerShell payloads, established persistence, and spread to other connected instances. ConnectWise separately advised disabling file transfers pending a fix for,

Key points

Huntress observed the campaign beginning in late August, with rogue ScreenConnect clients installed through social engineering.
The clients launched Windows Script Host processes to deploy four VBScript files; the scripts staged payloads, performed reconnaissance, and executed PowerShell.
A subsequent PowerShell script reportedly attempted a UAC bypass, erased staging evidence, and installed a concealed ScreenConnect client that checked for new hosts to propagate the script chain.
In an August 20 incident, a purported tech-support actor used Quick Assist to gain control of a victim’s machine; the attack was blocked after the scripts were executed.
Huntress also observed User Run Key persistence and installation of UltraViewer remote desktop software.
Separately, ConnectWise warned of a file-transfer issue affecting cloud and on-premises ScreenConnect deployments. It recommended disabling file transfers temporarily and said a CVE and fix were forthcoming.

Article Details

Attack Vectors: Social engineering was used to deploy rogue ScreenConnect clients on victims’ machines.
A threat actor posing as tech support instructed a victim to run Quick Assist, gaining control of the machine.
The rogue ScreenConnect clients spawned Windows Script Host processes to run VBScript files, which staged payloads and executed PowerShell scripts.
The scripts installed and concealed additional ScreenConnect clients that checked for new host connections and propagated the VBScript chain to other ScreenConnect endpoints.
Attackers established persistence using a Windows User Run Key and installed UltraViewer remote desktop software.
Defensive Notes: Huntress advised administrators to apply extra scrutiny to on-premises ScreenConnect installations.
ConnectWise recommended disabling ScreenConnect file transfer functionality as an interim risk-reduction measure while an official fix was pending.

MITRE ATT&CK

T1059.001 · PowerShellThe VBScript chain executed PowerShell scripts to erase staging evidence, attempt UAC bypass, and install a ScreenConnect client.T1059.005 · Visual BasicThe rogue ScreenConnect clients launched Windows Script Host to execute VBScript files.T1082 · System Information DiscoveryThe deployed scripts were described as performing system reconnaissance.T1219 · Remote Access ToolsThe campaign installed rogue ScreenConnect clients and UltraViewer for remote access.T1547.001 · Registry Run Keys / Startup FolderAttackers established persistence by creating a Windows User Run Key pointing to a VBScript file.T1548.002 · Bypass User Account ControlA PowerShell script attempted a UAC bypass.

Vendors

ConnectWise“From our conversations with ConnectWise and our current understanding of the risk, we suggest admins apply extra scrutiny to any on-premises ScreenConnect installations you may have within your environment,” Huntress

Products

Microsoft Quick AssistIn an August 20 attack, a threat actor posing as tech support instructed the victim to execute the Windows’s built-in remote support tool Quick Assist, thus gaining control over the victim’s machine.ScreenConnectModified ScreenConnect clients are being used in an attack campaign to spread malicious payloads to other endpoints, cybersecurity firm Huntress warns.UltraViewerThe attacker was also seen establishing persistence through the User Run Key, and installing the UltraViewer remote desktop software.