Attackers are using compromised ConnectWise ScreenConnect instances to automatically transfer and execute malicious payloads on newly connected clients in a campaign that exhibits worm-like self-propagating behavior.
The backdoored ScreenConnect servers deliver malware to endpoints that connect for remote support or management sessions. Once infected, those clients can further spread the attack, creating a lateral propagation pattern across organizations’ IT infrastructure.
Compromised ScreenConnect Servers Automatically Infect Connecting Clients
ScreenConnect is a remote access and support tool used by IT administrators and managed service providers to remotely control endpoints for troubleshooting, software deployment, and system management. The software operates on a server-client architecture where a central ScreenConnect instance manages connections to multiple remote systems.
In the campaign, attackers compromised ScreenConnect servers and modified them to deliver malicious code to any client that connects. The automated delivery mechanism means every endpoint that establishes a session with the backdoored server receives the payload without requiring attacker interaction for each individual infection.
Worm-Like Lateral Spread Across Trusted Remote Management Infrastructure
The campaign’s worm-like behavior stems from the way compromised clients can serve as new infection vectors. Once an endpoint receives the malicious payload from a backdoored ScreenConnect server, that system may itself host ScreenConnect services or connect to other ScreenConnect instances within the same organization, enabling further propagation of the malware.
This self-spreading characteristic accelerates the attack’s reach across network environments where ScreenConnect is deployed for managing multiple endpoints. The use of a trusted remote management tool as the infection vector also helps the malware evade detection, since ScreenConnect connections and file transfers are routine administrative activities that security tools typically allow.
Initial Compromise Method of ScreenConnect Instances Not Disclosed
Security outlets report did not specify how attackers initially compromised the ScreenConnect servers that serve as the campaign’s starting point. Possible attack vectors include exploitation of vulnerabilities in the ScreenConnect software itself, credential theft through phishing or password reuse, or compromise of the underlying server infrastructure through separate network intrusions.
ScreenConnect has been targeted in prior campaigns where attackers exploited authentication bypass vulnerabilities or brute-forced weak administrative credentials to gain control of instances. Once an attacker has administrative access to a ScreenConnect server, they can modify its configuration, deploy scripts to connected clients, or alter the file transfer mechanisms to deliver unauthorized payloads.
Malicious Payloads Delivered to Connected Endpoints
The specific malware delivered in this campaign was not detailed in the September 7 disclosure, but the automated delivery mechanism suggests attackers are prioritizing broad distribution over targeted payload selection. The malicious code could serve various purposes, including credential theft, ransomware deployment, remote access backdoor installation, or enrollment of infected systems into a botnet.
The payload’s execution on newly connected clients indicates the attackers modified the ScreenConnect server’s file transfer or script execution capabilities to run code on endpoints as soon as a session is established. ScreenConnect’s legitimate functionality allows administrators to push files and execute commands on remote systems, making it an effective platform for automated malware delivery once the server is under attacker control.
Trusted Remote Access Tools as High-Value Compromise Targets
The campaign demonstrates the strategic value of remote access and management tools as attack infrastructure. Organizations deploy ScreenConnect and similar products to centralize IT support operations, creating single points of control over dozens or hundreds of endpoints. Attackers who compromise these central management servers gain the same privileged access IT administrators use to deploy software and execute commands across the environment.
Remote management tools are frequently targeted in supply-chain attacks, where compromising a managed service provider’s ScreenConnect instance allows attackers to pivot into the networks of all clients serviced through that instance. The worm-like propagation observed in this campaign extends the supply-chain risk by enabling compromised clients to serve as secondary infection sources.
ScreenConnect Administrators Advised to Audit Instances and Connected Clients
Organizations using ScreenConnect are advised to audit their server instances for unauthorized modifications, review access logs for anomalous administrative activity, and scan connected endpoints for indicators of compromise. Administrators should verify that ScreenConnect servers are running the latest patched versions, that administrative credentials are strong and protected by multi-factor authentication, and that server access is restricted to trusted networks.
The campaign’s reliance on automated payload delivery suggests detection may be possible by monitoring ScreenConnect file transfer logs for unexpected executable files or scripts sent to multiple clients in rapid succession. Endpoint security tools that monitor ScreenConnect client behavior for anomalous process creation or network connections can also provide visibility into malicious activity initiated through compromised sessions.
Security researchers disclosed the campaign to help defenders build detection signatures and audit their ScreenConnect deployments for signs of compromise. The attack underscores the need for organizations to apply the same security rigor to remote management infrastructure that they apply to customer-facing applications, as compromise of these trusted administrative tools enables rapid, automated malware distribution across entire IT environments.
