# Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Modified ScreenConnect clients auto-pushed VBScript stagers to newly connected Hosts via file-transfer Run actions, spreading worm-like across unrelated orgs and installing backdoors and miners.

- Payout: Real-world hack
- Severity: critical
- Program: ConnectWise
- Analysis by: Huntress
- Disclosed: 2026-09-09
- CVE: CVE-2026-84869
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/rogue-screenconnect-installations
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rogue-screenconnect-installations
- Tags: area:os domain:desktop impact:mass-exploit impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:payment tech:windows technique:chained vuln:access-control vuln:privilege-escalation vuln:rce

**Target:** ScreenConnect remote support client/server sessions and Windows endpoints
**Root cause:** Client-side file-transfer handling allowed file-transfer actions to execute on the Host during an active remote session without Host authorization or confirmation; attackers used modified clients to queue Run actions carrying VBScript stagers to every new Host connection.
**Steps:**
1. Social-engineer victim into running Quick Assist or a rogue ScreenConnect.ClientSetup.msi/ScreenConnect.Client.exe pointing at attacker C2 (e.g. `45.13.237[.]190`, `131.123.40[.]98:8041`).
2. Rogue ScreenConnect client spawns `wscript.exe` to run `1.vbs`-`4.vbs` from its temp directory.
3. `1.vbs` profiles host into a 3-bit state written to `%TEMP%\value.txt` (ScreenConnect present, EDR present, RAM>5GB); writes `abort` if existing ScreenConnect found.
4. `2.vbs` downloads base64/XOR(90)-encoded `map.txt` from Dropbox and writes `%TEMP%\map.txt` mapping state bits to `url|AES_KEY`.
5. `3.vbs` matches state line, downloads `user.enc`/`acc.enc`/`combo.enc` to `%TEMP%\out.tmp` then renames to `out.enc`.
6. `4.vbs` reads AES key from map.txt, writes `runner.ps1`, decrypts out.enc (first 16 bytes as IV, AES-CBC/PKCS#7) to `%APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip`, runs `PyTorchFix.ps1`, kills wscript/cscript, cleans staging.
7. Modified ScreenConnect client watches `EndPointStatusMessage.Connections`, and on each new Host session registers `1.vbs`-`4.vbs` as a file-transfer message with action `Run`, queued to the Host.
8. 010/011 branch: UAC bypass via hijacked `ms-settings:` handler and `ComputerDefaults.exe`, AMSI bypass, Defender exclusions, installs concealed ScreenConnect client ID `7a4d7d66502d4260`, deploys wstunnel as `Themes.exe`, XMRig as `SearchIndex.exe`, WinRing0 `svcdrv64.sys`.
9. Persistence via `HKCU\...\Run\WindowsServiceHost` pointing to `WindowsServiceHost.vbs`.
**How found:** Huntress SOC flagged abnormal `ScreenConnect.WindowsClient.exe` spawning repeated `wscript.exe` children across unrelated orgs; pivoted to analyze the four VBS stagers, decoded map.txt, and reverse-engineered the modified ScreenConnect client to discover the file-transfer Run propagation.
**Exploitation:** Attackers socially engineered victims into installing rogue ScreenConnect clients, then used modified clients to automatically push the four-stage VBScript chain to any Host that connected, turning each infected client into a delivery node. Payloads branched by host profiling: user-level backdoor, persistence/privesc tooling, or tunneling plus XMRig miner. UAC bypass and AMSI bypass enabled elevated install of a hidden ScreenConnect client and Defender exclusions.
**Escalation:** Worm-like propagation: each infected client re-infects newly connecting Hosts, and ConnectionIDs are cleared on disconnect so reconnections re-trigger delivery. State-based branching escalates from user-level backdoor to privesc and miner deployment.
**Insight:** Legitimate RMM clients can be trojanized to abuse their own file-transfer/Run primitives for lateral spread; monitor for RMM binaries spawning script interpreters and for RunFiles/RanFiles audit events from Guest processes.