1. Basic Information

• Original Article Title: Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
• Publisher: Huntress
• Publication / Update Date: 2026-09-03
• Source: Huntress
• Related Source: SecurityWeek: Modified ScreenConnect Clients Used in Worm-Like Campaign
• Related Source: BleepingComputer: ConnectWise warns of new ScreenConnect flaw without patch
• Related Malware / Tools / Products: WindowsServiceHost, PyTorchFix, wstunnel, XMRig, ConnectWise ScreenConnect, Microsoft Quick Assist, Microsoft Defender, WinRing0
• Severity: High

2. Executive Summary

Modified ScreenConnect clients deploy malicious scripts and can spread the infection to operator endpoints that connect to an infected device.

In ScreenConnect terminology, the Guest is the endpoint receiving remote support, and the Host is the operator side of the session. The modified client on an infected Guest transfers scripts to a newly connected Host and requests their execution.

Payload behavior depends on the endpoint configuration. User-level remote access, UAC bypass, persistence, tunneling, and cryptocurrency mining should not be treated as stages that occur on every infected endpoint.

3. Attack Flow

1. Social engineering leads a user to grant remote access or run an unauthorized ScreenConnect installer. In one reported incident, the attacker used Quick Assist before deploying a rogue ScreenConnect client.
2. The client launches 1.vbs through 4.vbs. The scripts assess the environment, retrieve configuration and payload files, and use PowerShell to decrypt and run the selected payload.
3. Execution branches according to endpoint conditions. Different packages provide user-level remote access, persistence and privilege escalation, or tunneling and cryptocurrency mining.
4. A modified ScreenConnect client monitors new Host connections.
5. When an operator Host connects to the infected Guest, the modified client uses ScreenConnect's virtual file-transfer and Run functionality to send scripts to that Host and request execution.
6. A later reconnection can trigger the process again, creating a reinfection risk.

This is propagation through ScreenConnect sessions, rather than unrestricted scanning and infection of arbitrary devices on the network.

4. Attacker Position and Execution Context

• Initial access involves persuading a user to permit remote assistance or execute an unauthorized client.
• The attacker controls a rogue ScreenConnect deployment or modified client.
• Subsequent propagation involves an infected Guest and a Host connecting to it through ScreenConnect.
• Execution privileges depend on the payload branch and endpoint conditions. UAC bypass alone does not establish that a process runs as SYSTEM.

5. Visibility for Victims and Administrators

Victims

Users may receive unexpected support requests or instructions to open Quick Assist or install ScreenConnect. After the initial compromise, propagation through a remote-support session may occur without a separate user action to launch the transferred scripts.

Administrators

Relevant indicators include ScreenConnect spawning wscript.exe, execution of 1.vbs through 4.vbs, and a WindowsServiceHost entry under the current user's Run key.

Depending on the payload branch, additional evidence may include ComputerDefaults.exe, PyTorchFix.ps1, Themes.exe, or SearchIndex.exe.

ScreenConnect audit entries involving RunFiles or RanFiles from Process: Guest are particularly relevant when correlated with execution on the connected Host.

6. Success and Failure Conditions

Success Conditions

• The attacker establishes an unauthorized ScreenConnect client on an endpoint.
• An operator Host connects to an infected Guest, and the relevant file-transfer and execution functionality is available.
• The transferred scripts execute successfully on the receiving endpoint.
• Additional payload actions succeed where their configuration and privilege requirements are met.

UAC bypass, tunneling, and mining are not prerequisites for every form of compromise described in this campaign.

Risk Reduction

• Verify unexpected remote-support requests through a trusted, independent channel.
• Restrict unauthorized RMM installations and remote-assistance use.
• Huntress's September 3 update relayed ConnectWise's interim advice to disable TransferFiles, or TransferFilesInSession in legacy versions. Consult the current ConnectWise advisory for applicable fixes and updated guidance.
• Monitor suspicious RunFiles and RanFiles activity.
• For affected endpoints, Huntress recommends reimaging from known-good media or performing a clean operating-system installation. Removing only the visible tunnel or modified client may leave other components behind.

Inference: As part of recovery, identify potentially exposed credentials and rotate them according to the assessed scope of compromise.

7. Potential Impact

The following includes possible consequences of the payload branches, not activity confirmed on every affected endpoint:

• Code execution with user-level or elevated privileges.
• Persistence and interference with endpoint defenses.
• Infection of operator Hosts through connections to infected Guests.
• Reinfection following subsequent ScreenConnect connections.
• Tunneling, cryptocurrency mining, and additional payload execution.

Neither UAC bypass nor payload delivery alone proves SYSTEM-level execution or information theft.

8. Observable Logs

Inference: Use the following sources to investigate the activity. Available evidence will depend on the deployment and logging configuration.

• Email: If an email lure is identified, preserve the original message, links, recipients, and interaction timestamps. Do not assume email was the entry point for every incident.
• Proxy / SWG / DNS: Review relevant Dropbox downloads and resolution or connection records for homehub.opik[.]net. Dropbox use alone is not evidence of malicious activity.
• Endpoint / EDR: Examine ScreenConnect child processes, wscript.exe, the four VBS files, PowerShell, and ComputerDefaults.exe. Investigate Run keys, Defender exclusions, driver activity involving WinRing0, and suspected tunneling or mining processes.
• Identity / IdP: Where applicable, review the remote-support operator's authentication and account activity. These records do not replace endpoint evidence of script execution.
• ScreenConnect Server Audit: Correlate RunFiles, RanFiles, Process: Guest, session identifiers, and connected Host details.
• Network: Correlate connections to homehub.opik[.]net:443 with the suspected Themes.exe process. A network connection alone does not establish the full payload chain.

9. Determining Attack Success

Inference: These are investigation criteria, not a claim that all reported incidents reached every stage.

• Attack Attempt Observed — Success Unconfirmed: A suspicious support request or delivery of an unauthorized installer establishes an attempted entry point, not successful compromise.
• User Action Confirmed: Evidence shows that the user granted remote access or launched the unauthorized installer.
• Initial Execution Confirmed: Endpoint records show execution of transferred VBS or PowerShell scripts. UAC bypass is not required for this finding.
• Malware Execution Confirmed: Evidence establishes execution of a malicious client or payload, persistence, tunneling, or mining. Determine actual privileges from process evidence rather than assuming SYSTEM access.
• Information Theft or Session Compromise Confirmed: Evidence demonstrates unauthorized acquisition of credentials, sessions, or internal information. Downloading another payload does not by itself prove information theft.
• Propagation Confirmed: Correlated records establish both transfer to another endpoint and execution there. A transfer record alone does not prove successful infection.

10. Investigation Playbook

Inference: The following workflow applies the reported mechanisms to an organizational investigation.

• Trigger: Suspicious ScreenConnect script execution, a rogue client, or RunFiles / RanFiles activity originating from a Guest.
• Initial Assessment: Identify the client and its server URL, distinguish approved deployments from unauthorized ones, and preserve Guest, Host, session, and transfer identifiers.
• Endpoint Review: Examine VBS and PowerShell execution, persistence, defense changes, and any tunneling or mining components. Verify process privileges where elevation is suspected.
• Account and Permission Review: Check the operator accounts, sessions, and file-transfer or execution permissions involved.
• Propagation Review: Trace Host endpoints that connected to infected Guests. Check for execution after the first connection and after later reconnections.
• Containment and Recovery: Stop affected sessions and prevent further transfers from infected devices. Preserve relevant evidence, follow current vendor guidance, and rebuild affected endpoints from known-good media.
• Assessment: Keep file transfer, execution, privilege elevation, information theft, and propagation as separate findings supported by their own evidence.

11. Defense and Detection Ideas

Inference: These are operational detection proposals.

• Single Events: Investigate unexpected VBS or PowerShell execution from ScreenConnect and suspicious Guest-originated file-execution audit entries.
• Time-Series Correlation: Connect Guest-side transfer events to Host-side script execution using the session identifier and timestamps.
• Hunting: Prioritize operator endpoints that connected to known infected Guests. Look for matching scripts, persistence entries, defense changes, and tunneling or mining processes.
• Evidence Gaps: Server audit records may show a transfer without proving execution on the receiving Host. Preserve records from both endpoints.
• Priority Controls: Maintain an inventory of approved remote-support deployments, restrict unauthorized RMM use, apply current vendor mitigations, and prevent reconnection to infected Guests during recovery.

12. Facts / Inference / Hypothesis

Facts

• Huntress investigated rogue ScreenConnect deployments associated with social engineering, including an incident involving Quick Assist.
• The observed clients launched wscript.exe to execute 1.vbs through 4.vbs.
• The analyzed scripts profiled endpoint conditions, retrieved staged material from Dropbox, and used PowerShell with AES-CBC decryption to load selected payloads.
• Different payload branches provided user-level remote access, persistence and elevation tooling, or tunneling and cryptocurrency mining.
• One analyzed branch included a UAC-bypass mechanism involving ms-settings: and ComputerDefaults.exe, an AMSI-bypass attempt, Defender exclusions, power-setting changes, and service concealment.
• The modified client monitored EndPointStatusMessage.Connections and sent scripts to newly connected Host sessions through ScreenConnect's virtual file-transfer functionality.
• Some configurations used wstunnel as Themes.exe to connect to homehub.opik[.]net:443 and XMRig as SearchIndex.exe.
• Huntress recommended rebuilding affected endpoints from known-good media.

Inference

Operator endpoints used for legitimate support should be investigated if they connected to an infected Guest. The reported propagation mechanism makes the support connection itself relevant to exposure.

Hypothesis

No additional hypotheses. Unconfirmed matters are listed below.

13. MITRE ATT&CK Mapping

Inference: The following mappings describe the reported behaviors.

• T1219 Remote Access Software — High Confidence: Abuse of ScreenConnect for remote access.
• T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control — High Confidence: UAC bypass in an analyzed payload branch.
• T1105 Ingress Tool Transfer — High Confidence: Transfer of malicious scripts to another endpoint.
• T1572 Protocol Tunneling — High Confidence: Use of wstunnel for tunneled communications.

14. Unknowns and Further Investigation

• The complete distribution infrastructure and total number of affected organizations.
• The precise relationship between the product's file-transfer issue and the modified clients across affected versions.
• Which payload branches executed on each endpoint and with what privileges.
• The scope of subsequent activity or information theft through established remote access and tunnels.

15. Impact on SOCs and Organizations

Managed service providers and help desks should maintain an inventory of approved ScreenConnect deployments, server URLs, and client provenance. Signatures and filenames are useful context, but should not be the sole basis for trust.

The direction of propagation is especially important: an operator Host may be exposed when connecting to an infected Guest. Investigations should therefore include support workstations as well as the originally affected endpoints.

Stop affected sessions and file transfers while rebuilding infected devices. These containment actions do not imply that the ScreenConnect management server itself was confirmed compromised.

16. Summary by Target Audience

• For SOCs: Trace Host connections to infected Guests and correlate file-transfer records with endpoint execution. Assess privilege elevation, mining, and information theft separately.
• For Administrators: Restrict unauthorized RMM use, follow current ConnectWise guidance, and investigate suspicious Guest-originated file-execution activity. Prevent affected support sessions from restarting before recovery is complete.
• For End Users: Verify unexpected support requests through your organization's known contact channel. Do not grant remote access or install support software solely because an unsolicited caller or message asks you to do so.