Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Summary

Worm-like activity abuses ConnectWise ScreenConnect to spread VBScript payloads. Three incidents used varied access methods to install rogue ScreenConnect clients. The VBScript chain profiles hosts, downloads payloads, and deploys backdoors, privilege escalation tools, or cryptocurrency miners.

Key Takeaways

1. Worm-like activity abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems.
2. Three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form lure, to activate a four-stage VBScript chain that leads to rogue ScreenConnect installations.
3. The incidents share additional indicators, including a WindowsServiceHost User Run Key pointing to WindowsServiceHost.vbs in the user's AppData directory.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents detailed technical information about a cybersecurity threat, citing a specific research company. It outlines attack vectors, VBScript chain stages, and payloads with technical accuracy. The inclusion of ConnectWise's advisory and mitigation steps further enhances its credibility.

Bias assessment: Technical Reporting. The article focuses on reporting technical details of a cybersecurity incident. It avoids emotional language or partisan framing, presenting information objectively. The primary lens is that of cybersecurity analysis and threat reporting.

Note: This article provides in-depth technical details on a cybersecurity threat. While highly informative, readers should cross-reference with official advisories for the most current mitigation strategies.

Credibility flag: Technical, Verified

Claimed Facts (9)

• This is a direct statement of fact about the discovery and nature of the threat.
• This attributes specific findings to a named cybersecurity company, presenting them as factual observations.
• This is a factual statement introducing a list of described attack scenarios.
• This describes the specific functions of a VBScript file as observed and reported.
• This details the conditional logic and actions of another VBScript file.
• This describes the functionality of the third VBScript in the chain.
• This outlines the final VBScript's actions, including the execution of PowerShell scripts.
• This is a factual statement introducing the different types of payloads observed.
• This reports on an official action taken by ConnectWise based on the reported findings.

Opinions (5)

• The term 'worm-like behavior' is an interpretation of the observed activity, not a directly verifiable fact without further context.
• This statement describes a potential consequence, framed as a possibility ('can cause') rather than a guaranteed outcome.
• While the indicator is factual, the implication that these are shared indicators across incidents is an interpretation by Huntress.
• The phrase 'strong recommendations' reflects an opinion or judgment by the Huntress SOC regarding the severity and necessary response.
• This statement from ConnectWise, while presented as fact, is an assertion about the scope of an issue, which could be subject to interpretation or further verification.

Claims (5)

• This statement highlights an unknown element (payload nature) due to a missing resource, making it a claim based on incomplete information.
• This is a specific claim about the execution method that, while likely true in context, is a detailed technical assertion that could be difficult to independently verify without direct observation of the specific incident.
• This describes a specific behavioral mechanism of the malware that, while plausible, is a detailed assertion about its internal logic that is hard to verify without deep analysis.
• This is a very specific claim about file placement under certain conditions, which is a granular detail that is difficult to independently verify from the article alone.
• The phrase 'effectively turning' suggests a strong outcome that, while likely, is an interpretation of the system's function rather than a directly observable fact.

Key Sources

• Huntress — Cybersecurity Company
• ConnectWise — Software Company