Huntress Unveils a Self-Propagating Malware Campaign Targeting ScreenConnect Installations
In a significant revelation, cybersecurity firm Huntress has reported a concerning wave of malicious installations of ScreenConnect, a popular remote-support tool. This recent exposure details a fascinating yet alarming self-propagating attack that spreads without the need for further action from either victims or attackers, drawing parallels to the mechanics of a computer worm.
In a blog post released this week, Huntress disclosed how its Security Operations Center (SOC) detected the same unusual activity patterns across several unrelated customer environments in late August. Following an in-depth investigation, researchers identified that these incidents were interconnected via a shared attack chain, which was built on modified iterations of ScreenConnect. This legitimate remote-access software, developed by ConnectWise, is commonly utilized by IT teams and help desks to provide support to end-users remotely.
A Familiar Scam with an Innovative Twist
Exploring the individual incidents, Huntress observed that each began with social engineering tactics. For instance, one case involved a victim who ran Microsoft’s built-in Quick Assist tool after being persuaded, most likely through a fraudulent tech-support call, that their computer had been compromised. This manipulative tactic, often employed in tech-support scams, underscores the vulnerabilities victims face in trusting unsolicited help. In another scenario, a user searching for a Geek Squad refund form was inadvertently led to download and execute a counterfeit ScreenConnect installer.
Once the rogue version of ScreenConnect was installed, the aftermath was alarming. Each compromised machine commenced repeatedly launching the Windows Script Host process, triggering a series of four VBScript files—simply named 1.vbs through 4.vbs. Huntress noted that this behavior, combined with a persistence mechanism disguised as a “WindowsServiceHost” registry entry, was consistently observed across all the examined incidents, despite the organizations involved showing no apparent ties to each other.
According to the in-depth analysis by Huntress, the four scripts operate in distinct stages. The first script is tasked with profiling the infected machine, checking for the presence of an existing ScreenConnect installation, identifying active security products, and confirming that the system possesses enough memory to resemble a real computer rather than a malware analyst’s virtual machine. After forming this profile, subsequent scripts proceed to pull down and decrypt additional payloads, which could incorporate a backdoored version of the ScreenConnect client, tools meant for privilege escalation and persistence, or packages containing tunneling software along with a cryptocurrency miner.
Transforming Victims into Viral Distribution Points
What sets this campaign apart, as emphasized by Huntress, is its unique propagation method. Nestled within the compromised ScreenConnect client is a piece of code designed to monitor incoming remote support sessions. Upon detecting a new connection, the infected client automatically packages and delivers the same four VBScript files to the newly connected system, initiating the infection cycle anew.
In practical terms, this means that during what appears to be a legitimate support session—where a technician or help desk agent remotely assists a user on a compromised machine—there lies the danger of the malware spreading further into the technician’s environment, necessitating no additional phishing tactics or social engineering at that juncture. Huntress revealed that the infected client diligently tracks the sessions it has already targeted, discarding that record once a session concludes, allowing for the potential of reinfection upon later reconnection.
Moreover, Huntress noted the discovery of secondary remote access tools, such as UltraViewer, on some of the compromised devices. This finding suggests that the attackers are establishing multiple footholds within their targets, ensuring access continues even if one method is discovered or removed.
Insights into Advanced Development Techniques
As researchers at Huntress examined the scripts, they stumbled upon an enlightening detail: an embedded comment within one of the VBScript files articulated, in unusually clear language, how to extract an encryption key from a configuration file. This kind of straightforward commentary suggests a possible connection to code generated with the assistance of a large language model.
Recommendations to Fortify Security
Given the extensive level of access the malware can achieve—potentially disabling Microsoft Defender reporting and bypassing User Account Control—Huntress strongly recommends wiping and reimaging any confirmed infected machines using known-clean media, rather than attempting to clean them in place.
The firm advises administrators to closely scrutinize any on-premises ScreenConnect deployments, suggesting they review audit logs for any RunFiles or RanFiles entries linked to scripts executed from a “Guest” process, which should be treated as immediate warning signs. Additionally, Huntress cautioned that the specific filenames associated with this infiltration may evolve over time, and any unexpected Windows Script Host or PowerShell activity related to ScreenConnect sessions should trigger immediate investigations.
In direct communication with ConnectWise, the developer of ScreenConnect, Huntress continues to monitor the escalating activity. Their report also includes a comprehensive set of indicators of compromise, comprising file hashes and command-and-control infrastructure, enabling defenders to check against their own environments.
According to Huntress, tools like ScreenConnect, used for remote monitoring and management, have emerged as some of the most exploited categories of software this year. Previously, the firm documented various social-engineering campaigns utilizing similar tools to gain initial access to victim networks. What distinguishes this latest campaign is the introduction of automated, worm-like propagation alongside an already recognized attack vector, representing a sophisticated evolution in cyber threats.
The ongoing developments in cybersecurity underscore the ever-changing landscape of threats organizations face, highlighting the critical importance of vigilance and proactive security measures.