Loading story…
Huntress identified a campaign in which attackers use social engineering—including fake technical support, phishing, fraudulent refund-search results, and Quick Assist abuse—to persuade victims to install trojanized ConnectWise ScreenConnect clients. Rather than exploiting a ScreenConnect vulnerability, the altered remote-support software detects incoming sessions and uses ScreenConnect file-transfer and remote-execution functions to send a staged four-part VBScript loader to the connecting endpoint, potentially infecting technician and help-desk systems without further user interaction.
The payload chain profiles hosts, establishes persistence, seeks elevated execution, and can deploy remote-access, tunneling, and cryptocurrency-mining tools while attempting to evade security controls, including Microsoft Defender reporting and User Account Control. Huntress observed the activity at unrelated organizations during late-August incidents and advises organizations to reimage confirmed compromised systems, review ScreenConnect deployments and audit logs, and investigate suspicious Windows Script Host or PowerShell execution linked to ScreenConnect sessions.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
ConnectWise advised partners to disable technician file-transfer permissions until an official fix is available. The mitigation can be applied immediately through ScreenConnect role settings without upgrading the product.
ConnectWise published an advisory acknowledging an issue in ScreenConnect file-transfer behavior affecting both cloud and on-premises deployments. The company said it intended to issue a CVE and an official fix within the following week.
In late August, Huntress observed malicious, unauthorized ConnectWise ScreenConnect installations across unrelated organizations. Attackers used social-engineering lures, including fake technical-support and refund scams, to get victims to grant remote access or run rogue installers.
Huntress recommended reimaging confirmed infected hosts from known-good media, reviewing ScreenConnect deployments and audit logs for Guest-process script execution, and investigating suspicious Windows Script Host or PowerShell activity. It also supplied indicators of compromise and said it was in direct contact with ConnectWise while monitoring the activity.
The modified clients executed a four-stage VBScript chain and transferred the scripts to systems connecting through incoming ScreenConnect sessions, enabling worm-like spread into technician or help-desk environments. Payload branches established persistence and could deploy elevated remote access, tunneling tools, and cryptocurrency miners while attempting security-product evasion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcecyberveille.ch
Open sourceinfosec.pub
Open sourcecybersecuritynews.com
Open sourceitsecurityguru.org
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Huntress investigated two late-August phishing intrusions in which attackers used browser-in-the-browser (BiTB) pages impersonating Adobe Acrobat or Reader to convince victims to install unauthorized ScreenConnect remote-management clients. Victims were led through malicious links and fake CAPTCHA or PDF-viewer lures to counterfeit Adobe browser windows that displayed the legitimate-looking `get.adobe.com` address within page content. In each incident, the initial ScreenConnect installation downloaded and installed a second rogue ScreenConnect client, providing redundant service-based persistence and remote-access channels. The attackers also ran `HideCursor.exe` or `HideUL.exe` to conceal interactive activity; Huntress contained both intrusions before additional compromise. Microsoft Defender detected a command associated with `patch.msi` in one case but did not stop deployment of the second ScreenConnect client.
Sep 10, 2026
Threat actors including **Black Basta** have been actively exploiting recent **ConnectWise ScreenConnect** vulnerabilities to gain access to victim environments, then using that foothold to deepen control and prepare for follow-on attacks. Trend Micro reported post-compromise reconnaissance against domain controllers, including enumeration of domain computers, trusts, domain controllers, and local administrators, indicating efforts to map enterprise networks and identify privileged access. Attackers were also observed deploying additional remote management tools to maintain persistence and broaden remote access. In compromised environments, they abused **BITSAdmin** to download and execute another ScreenConnect client from `transfer[.]sh`, and in several European targets—mostly in **Belgium**—they installed trial versions of **Atera RMM** using `msiexec` parameters linked to an Outlook email account and account identifiers. Researchers warned that the activity could quickly progress to **ransomware deployment**, data theft, operational disruption, and financial losses, making immediate patching to the latest ScreenConnect version critical.
Jun 29, 2026