ScreenConnect Campaign Leveraging VBScript Payload Chain

Source Material: Huntress; ConnectWise Trust Advisory; | Technology: ConnectWise ScreenConnect Remote Access Support and Access sessions | Targeted Industries: Opportunistic

Executive Summary

Open source reporting has detailed a recent campaign in which threat actors used social engineering to install ConnectWise ScreenConnect clients and then executed a staged VBScript payload chain. The notable behavior is propagation-like activity in which modified ScreenConnect clients can transfer and execute the same scripts on newly connected ScreenConnect endpoints.

ConnectWise published a September 3, 2026 advisory acknowledging an issue affecting file-transfer behavior in ScreenConnect Remote Access Support and Access sessions across both Cloud and On-Premise deployments. ConnectWise stated that a CVE identifier and patched release are expected, and recommended disabling technician file-transfer permissions as an interim control for organizations using ScreenConnect, however the observed campaign primarily uses social engineering to trick victims into installing ScreenConnect, so the recommended mitigation doesn’t protect organizations who aren’t enabling and configuring ScreenConnect for legitimate use.

Customers should treat suspicious or unauthorized ScreenConnect installations as high-priority incidents. Prioritize inventory authorized RMM tooling to establish baseline policies and alert on or block unauthorized remote access utilities (such as rogue ScreenConnect), and consider reimaging hosts where the described payload chain or persistence artifacts are confirmed.

Threat Overview and Strategic Impact

The reported activity begins with a Quick Assist tech-support scam, a likely phishing-delivered ScreenConnect MSI, and fake refund-form lures which led victims to execute ScreenConnect clients. Once installed, those clients repeatedly launched Windows Script Host to execute staged VBScript files.

The scripts profile the host, check for security products, stage additional payloads from external infrastructure, and invoke PowerShell to decrypt and execute follow-on components. Reporting indicates payload branches for user-level ScreenConnect backdoors, persistence and privilege-escalation tooling, tunneling utilities, attempts to weaken Microsoft Defender and memory-integrity protections, and XMRig cryptocurrency mining.

The novel risk is propagation through ScreenConnect session behavior. Researchers found modified clients that monitor for newly observed Host connections and use ScreenConnect file-transfer/run mechanisms to queue and execute the same VBScript stagers on connected endpoints. This can turn an infected endpoint into a delivery point for other systems that connect to it.

As of September 8, 2026, ConnectWise has acknowledged a ScreenConnect file-transfer behavior issue and interim mitigation for organizations using ScreenConnect, however ConnectWise has not publicly confirmed a technical link between that issue and the reported campaign. No public CVE identifier or CVSS score are currently available.

Security Hardening and Recommendations

Mitigating this threat requires a dual approach: technical controls to restrict execution and user education to block the initial social engineering lure. Organizations should prioritize training staff to identify tech support scams, verify remote assistance requests, and report unverified software prompts. Complementing these awareness efforts, the technical recommendations below detail immediate containment, auditing, and hardening steps.

For organizations legitimately using ScreenConnect, immediately review ScreenConnect roles and disable TransferFiles permissions, or TransferFilesInSession in legacy versions, unless explicitly required. Apply ConnectWise guidance and monitor the advisory page for the promised CVE and patched release.

Inventory all ScreenConnect and other RMM installations, confirm expected ownership and server destinations, and remove unauthorized clients. Treat unknown ScreenConnect instances, hidden services, unexplained Run keys, or ScreenConnect sessions launching script interpreters as suspicious.

For confirmed compromise matching this campaign, reimage affected hosts from known-good media, rotate credentials used on affected systems, review remote-access audit logs if available, validate endpoint protection health, and check for additional RMM tools such as UltraViewer that may have been installed during the intrusion.

Detection Strategy

Prioritize detections for ScreenConnect client processes spawning wscript.exe, cscript.exe, or powershell.exe, especially when executing VBScript files such as 1.vbs through 4.vbs from ScreenConnect or Temp directories. If legitimate use of ScreenConnect is present in the environment, review ScreenConnect audit logs for RunFiles or RanFiles entries involving suspect scripts executed from Process: Guest.

Hunt for persistence through HKCU\Software\Microsoft\Windows\CurrentVersion\Run values named WindowsServiceHost that reference WindowsServiceHost.vbs under user AppData paths. Network detections should include unexpected ScreenConnect connections to unapproved infrastructure and the indicators shared below where operationally appropriate.

Behavioral detections should also watch for attempts to disable Microsoft Defender reporting or notifications, add broad Defender exclusions, run tunneled traffic through wstunnel-like binaries, deploy XMRig masquerading as Windows components, or load known vulnerable drivers such as WinRing0.

How Deepwatch Protects Our Customers

Deepwatch helps customers identify suspicious remote-access behavior by correlating endpoint, identity, and network telemetry with managed detection content and expert-led investigation. For this campaign, relevant coverage includes anomalous RMM execution, script interpreter child processes, suspicious persistence, defense-evasion activity, and outbound connections to unapproved remote-access infrastructure.

Deepwatch experts support rapid triage by validating whether ScreenConnect activity is expected, reviewing audit logs and endpoint process trees, identifying related RMM tools, and escalating confirmed compromise for containment and eradication.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.

Threat Hunting Leads

Hunt for ScreenConnect.WindowsClient.exe or ScreenConnect.ClientService.exe spawning wscript.exe, cscript.exe, powershell.exe, or cmd.exe.
Identify unauthorized ScreenConnect clients, unexpected ScreenConnect server destinations, hidden ScreenConnect services, and missing uninstall registry entries.
Review HKCU Run keys for WindowsServiceHost values pointing to AppData-hosted VBS files.
Look for UltraViewer, Quick Assist abuse, wstunnel masquerading as Themes.exe, XMRig masquerading as SearchIndex.exe, and WinRing0 driver artifacts.
For confirmed matches, scope connected hosts because modified clients may attempt to transfer and execute the payload chain over subsequent ScreenConnect sessions.
For organizations using legitimate, approved ScreenConnect – search ScreenConnect audit logs for RunFiles or RanFiles actions tied to 1.vbs, 2.vbs, 3.vbs, 4.vbs, WindowsServiceHost.vbs, or script execution from Process: Guest.

Technical Artifacts

Please visit the Guardian Platform to access the associated technical artifacts.

Threat Object Mapping

Intrusion Set:

Unknown / Unattributed

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Initial Access / Execution	Phishing / User Execution / Script Execution	T1566; T1204; T1059.005; T1059.001	Social engineering lures lead users to Quick Assist or rogue ScreenConnect installers; stagers execute through wscript.exe and PowerShell.
Persistence / Defense Evasion	Registry Run Keys / Impair Defenses	T1547.001; T1562.001	WindowsServiceHost Run key, AMSI bypass attempt, Defender exclusion creation, and concealment of ScreenConnect client/service artifacts.
Command and Control / Lateral Movement	Remote Access Software	T1219	Modified clients monitor new ScreenConnect Host connections and transfer/run the VBScript chain on connected endpoints.

Vulnerabilities:

ScreenConnect Remote Access Guest File Transfer behavior issue; CVE pending as of September 8, 2026.

Malware/Tool:

Rogue or modified ScreenConnect clients; VBScript stagers 1.vbs through 4.vbs; WindowsServiceHost.vbs; PyTorchFix.ps1; UltraViewer; Quick Assist; wstunnel masquerading as Themes.exe; XMRig masquerading as SearchIndex.exe; WinRing0 driver svcdrv64.sys.