Rogue ScreenConnect Clients Deploy Multi‑Stage VBScript Worm to Fresh Connections

How the Four‑Stage VBScript Chain Operates

A new worm‑like campaign is exploiting ConnectWise ScreenConnect to spread a malicious Visual Basic Script across corporate networks, researchers say. Huntress identified three separate incidents in the past month where compromised ScreenConnect clients automatically delivered the payload to any system that later connected to the same remote‑access session. The attacks originated from unrelated threat actors but shared a common four‑stage infection chain.

The malicious chain begins when a compromised ScreenConnect host injects a hidden script into the remote‑access client. When a new device joins the session, the script silently copies a VBScript file onto the newcomer, then executes it to establish persistence and download additional tools. Huntress analysts observed that the worm leverages ScreenConnect’s built‑in file‑transfer feature, bypassing traditional antivirus detection by masquerading as legitimate remote‑support traffic. The researchers noted that the attackers appear to target organizations that rely heavily on remote support, seeking to move laterally without triggering alerts.

The infection process unfolds in four distinct steps. First, the attacker gains initial access to a ScreenConnect server, often through stolen credentials or exploiting known vulnerabilities. Second, a custom client module is uploaded, embedding a hidden VBScript downloader. Third, whenever a new host connects to the compromised session, the module automatically transfers the script, which then runs silently in the background. Finally, the script establishes a scheduled task to ensure it re‑executes after reboots and reaches out to a command‑and‑control server for further instructions. Huntress reported that the payload can download ransomware, credential stealers, or additional remote‑access tools, depending on the attacker’s objectives.

Why Are Remote‑Access Tools Becoming Prime Targets?

Remote‑access platforms like ScreenConnect are attractive to cybercriminals because they already possess trusted communication channels between endpoints. „These tools are designed to be invisible to end users, which makes them perfect for covert payload delivery,” said a senior analyst at Huntress. The researchers warned that many organizations overlook the security of their remote‑support infrastructure, assuming the vendor’s built‑in protections are sufficient. However, the recent worm demonstrates that a single compromised client can become a distribution hub, rapidly infecting dozens of machines within minutes.

The campaign’s reliance on VBScript, a legacy scripting language, also helps it evade modern detection. Although Microsoft has deprecated VBScript in newer Windows versions, many enterprises still run legacy systems where the interpreter remains active. This backward compatibility provides a fertile ground for the worm’s execution.

The fallout from these infections can be severe. Compromised hosts may be turned into bots for large‑scale spam, used to exfiltrate sensitive data, or enlisted in ransomware attacks. Organizations that depend on remote support for critical operations risk widespread disruption if the worm spreads unchecked. Huntress recommends immediate review of ScreenConnect configurations, enforcement of multi‑factor authentication, and regular auditing of client binaries for unauthorized modifications.

Frequently Asked Questions

What immediate steps should IT teams take to stop the worm? Disable unused ScreenConnect sessions, enforce strong passwords and MFA, and scan all client machines for unknown VBScript files. Apply the latest patches from ConnectWise and monitor network traffic for unusual file‑transfer activity.

Can the worm affect systems that do not use ScreenConnect? The worm specifically targets devices that join a compromised ScreenConnect session. Systems never connecting through the tool are unlikely to be infected directly, though they could be targeted later via lateral movement.

Is VBScript still a threat on modern Windows environments? Yes. While newer Windows builds limit VBScript usage, many organizations run legacy applications that keep the interpreter enabled, allowing malicious scripts to run unnoticed.