Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Cybersecurity researchers have found that malicious actors are using ConnectWise ScreenConnect to spread a malicious VBScript payload to newly connected systems. This worm-like activity has been observed in three unrelated incidents, which used different initial access methods. The methods included a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake entity. The payload is distributed in a four-stage chain. The incidents were identified by Huntress, which disclosed details of the malicious activity. The diverse initial access methods suggest that the attackers are using various tactics to gain initial access to systems.