Modified ScreenConnect Clients Used in Worm-Like Campaign

A campaign is using modified ScreenConnect clients in a worm-like attack. The attacks utilize backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients. This approach allows the attackers to spread their malicious payloads to new targets. The campaign's use of compromised ScreenConnect instances is a key component of its operation. The backdoored instances play a crucial role in facilitating the transfer of payloads. The attack's worm-like behavior enables it to propagate to newly connected clients.