Rogue ScreenConnect clients are pushing VBScripts to every endpoint that connects
ConnectWise's September 3 advisory promises a CVE and a fix within the week, so until one lands the only control is a per-role permission change. Huntress says the spread is already worm-like across newly connected machines.
The Watch · Security desk
What happened
- ConnectWise confirmed a file transfer flaw in ScreenConnect Remote Access Support and Access sessions that affects both its cloud-hosted and On-Premise deployments.
- Huntress research describes rogue ScreenConnect clients spreading malware to every new machine that connects to them, with the modified clients executing four VBScripts on connected endpoints.
- The documented payloads covered persistence, additional ScreenConnect installations, tunneling, security-control changes, and cryptocurrency mining.
- ConnectWise's interim guidance is to deselect TransferFiles for technician roles, a setting change it says needs no version upgrade and can be applied immediately.
Why it matters
- What it limits constraint The published workaround has no global switch: each assigned role has to be edited by hand across its session groups, and technicians lose file transfer for as long as it holds.
- Who's exposed exposure Because propagation follows the session, one compromised instance reaches whichever machines connect to it next, so the exposed population keeps growing after the initial victim.
- Who has to decide decision Cloud tenants inherit ConnectWise's fix when it ships, while self-hosting shops schedule their own upgrade and, on Huntress's advice, give those instances extra scrutiny first.
- What it sets up precedent Bolting self-propagation onto RMM abuse, which Huntress already ranks a top vector, turns support tooling into the delivery channel and makes the technique worth copying.
Next story · Security · Oct 9
Attackers chain two unpatched AhsayCBS flaws to plant webshells on MSP backup serversConfirmed6 publishers
The order of operations decides what the mitigation buys. Huntress found that every incident it examined began with social engineering that put a rogue ScreenConnect instance on the victim's machine [3]. Deselecting TransferFiles does not touch that step. What it removes is the next one: modified clients executing 1.vbs through 4.vbs against endpoints that connect to them, which is where Huntress locates the worm-like spread across newly connected systems [6]. Read it as a propagation control rather than an entry control, and the guidance stops looking like a substitute for the patch.
Detection is cheap here. The rogue clients spawned repeated Windows Script Host processes, which Huntress flagged as abnormal behavior [4]. Persistence was a registry Run key named WindowsServiceHost pointing at a matching script in the affected user's AppData directory [5]. Inside ScreenConnect's own audit logs, Huntress says to look for RunFiles or RanFiles entries tied to a guest process [13]. Each of those is a hunt that runs against data an MSP already has.
The dates are the part to hold ConnectWise to. The advisory is dated September 3 and says a CVE identifier and an official fix will be issued within the week [9], which puts the fix due on or about September 10 [19]. The Help Net Security account of the advisory and the Huntress research is dated September 7 [16], four days into that window, with the role permission change still the published control [20].
What the material does not carry is scale. No victim count, no severity score, no CVE number, and no named operator behind the VBScript chain appear in either ConnectWise's advisory or the Huntress research as reported [18]. Huntress does place this inside a pattern rather than an isolated event: it calls RMM abuse a top attack vector it has tracked over the past year [10]. The staged design supports that read, with the scripts used for host profiling, concealment, and retrieving or launching further components [7].
The remediation cost lands downstream. Huntress recommends reimaging any machine already showing signs of compromise from known-good media [14], and the propagation model tells you which machines to check first: the ones that connected to a rogue instance after it landed. For a service provider, that list is customer endpoints, and it grows for as long as file transfer stays enabled on technician roles.
What to watch
- The CVE identifier and fix build ConnectWise promised, and whether the affected-version scope widens when the number is published.
- Any victim count or operator attribution from Huntress or ConnectWise, neither of which has published one.
- The same 1.vbs-to-4.vbs chain appearing behind a different RMM product, which would make it a propagation technique rather than a ScreenConnect problem.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence64
Perspective Coverage
3 publishers- Builder
- Builder 38%
- Operator
- Operator 57%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ConnectWise confirmed a file transfer flaw in ScreenConnect Remote Access Support and Access sessions that affects both Cloud and On-Premise deployments.
- [2]
Huntress research described rogue ScreenConnect clients spreading malware to every new machine that connects to them.
- [3]
Huntress said every incident began with social engineering that led to rogue ScreenConnect instances being deployed on victims' machines.
- [4]
After the rogue instances landed, the clients began spawning repeated Windows Script Host processes, flagged as abnormal behavior, to deploy four VBScript files named 1.vbs through 4.vbs.
- [5]
Attackers were seen creating a Windows registry Run key named WindowsServiceHost pointing to a matching script file in the affected user's AppData directory.
- [6]
Huntress said the attack used modified ScreenConnect clients to propagate the VBScript chain, executing the four files 1.vbs to 4.vbs on connected ScreenConnect endpoints and creating worm-like spread across newly connected systems.
- [7]
Huntress described the payloads as a staged attack designed to profile hosts and conceal activity, with the scripts used for system discovery and to retrieve or launch additional components.
- [8]
Huntress documented payloads associated with persistence, additional ScreenConnect installations, tunneling, security-control changes, and cryptocurrency mining.
- [9]
In its September 3 advisory ConnectWise wrote: "A CVE identifier and an official fix will be issued within the week."
- [10]
Huntress said RMM abuse is a top attack vector it has tracked over the past year.
- [11]
Until a fix is available ConnectWise recommends partners disable file transfers for technicians, via Administration > Security > Roles, editing each assigned role and reviewing permissions for each session group, deselecting TransferFiles or TransferFilesInSession on legacy versions, with the change applied to each applicable role.
- [12]
ConnectWise stated that the setting change does not require a version upgrade and can be applied immediately.
- [13]
Huntress advises checking ScreenConnect audit logs for RunFiles or RanFiles entries tied to a guest process.
- [14]
Huntress recommends reimaging any machine already showing signs of compromise from known-good media.
- [15]
Huntress said that based on its conversations with ConnectWise and its current understanding of the risk, admins should apply extra scrutiny to any on-premises ScreenConnect installations in their environment.
- [16]
The Help Net Security report on the ConnectWise advisory and Huntress research is dated September 7, 2026.
- [17]
ScreenConnect is a remote support and access product used by IT departments and MSPs, and can be hosted by ConnectWise in its cloud or self-hosted on-premises or in a customer's own private cloud.
- [18]
Neither the ConnectWise advisory nor the Huntress research as reported includes a victim count, a severity score, a CVE identifier, or a named threat actor.
- [19]
A fix promised "within the week" in a September 3 advisory falls due on or about September 10.
- [20]
As of the September 7 report, four days into ConnectWise's stated week, the role permission change was still the published control and no fix had shipped.
Sources
3 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comAttackers spread malware through ScreenConnect file transfers
1 article · September 7, 2026
- securityweek.comModified ScreenConnect Clients Used in Worm-Like Campaign
1 article · September 7, 2026
- thehackernews.comRogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
1 article · September 7, 2026
Topics and entities
Topics
- Legitimate RMM Abuse
- Self-Propagating Malware
- Social Engineering and Voice Phishing