Cybersecurity agency Huntress has uncovered a wave of malicious installations of ScreenConnect, a extensively used remote-support instrument, that unfold between machines with none additional motion from a sufferer or an attacker, a self-propagating assault chain researchers likened to a pc worm.
In a weblog put up revealed this week, Huntress mentioned its Safety Operations Middle (SOC) had flagged the identical uncommon sample of exercise throughout a number of unrelated buyer environments in late August. Investigators later discovered the incidents have been linked by a shared assault chain constructed round modified, or “rogue,” copies of ScreenConnect, a official remote-access product made by ConnectWise that IT groups and assist desks use to help finish customers remotely.
A well-known rip-off, an unfamiliar twist
Every incident Huntress examined started with social engineering. In a single case, a sufferer ran Microsoft’s built-in Fast Help instrument after being satisfied, possible by way of a faux tech-support name, that their pc had been compromised, a well-worn tactic in tech-support scams. In one other, a consumer looking on-line for a Geek Squad refund type was as an alternative led to obtain and run a bogus ScreenConnect installer.
As soon as the rogue ScreenConnect shopper was put in, every contaminated machine started repeatedly launching the Home windows Script Host course of to run a sequence of 4 VBScript information, named merely 1.vbs by way of 4.vbs. Huntress mentioned this behaviour, together with an identical persistence mechanism disguised as a “WindowsServiceHost” registry entry, appeared persistently throughout each incident, regardless of the organisations concerned having no apparent connection to at least one one other.
In keeping with Huntress’s evaluation, the 4 scripts work in levels. The primary profiles the contaminated machine, checking whether or not ScreenConnect is already put in, cataloguing which safety merchandise are working, and confirming the system has sufficient reminiscence to plausibly be an actual pc moderately than a malware analyst’s digital machine. Based mostly on that profile, later scripts pull down and decrypt further payloads, which may embrace a backdoored ScreenConnect shopper, instruments for privilege escalation and persistence, or a bundle containing tunnelling software program and a cryptocurrency miner.
Turning victims into distribution factors
Probably the most hanging ingredient of the marketing campaign, Huntress mentioned, is the way it spreads. Buried contained in the backdoored ScreenConnect shopper is code that watches for brand spanking new incoming remote-support classes. When a brand new connection seems, the contaminated shopper robotically packages up the identical 4 VBScript information and pushes them to the newly linked system, triggering the identical an infection chain there too.
In apply, meaning a official help session, a technician or assist desk agent remotely connecting to a compromised machine to help a consumer, might end result within the malware spreading onward to the technician’s personal atmosphere, with no further phishing or social engineering required at that stage. Huntress mentioned the contaminated shopper retains observe of which classes it has already focused, however drops that report as soon as a session ends, permitting the identical host to be reinfected on a later reconnection.
Huntress additionally noticed secondary remote-access instruments, together with UltraViewer, deployed on some compromised machines, suggesting the attackers have been establishing a number of footholds in case one was found and eliminated.
Researchers level to LLM-assisted improvement
Whereas unpacking the scripts, Huntress researchers famous a remark embedded in one of many VBScript information that appeared to elucidate, in unusually plain language, the right way to parse an encryption key out of a configuration file, the sort of explanatory remark researchers mentioned was per code generated with the assistance of a giant language mannequin.
What organisations ought to do
Given the depth of entry the malware can acquire, together with makes an attempt to disable Microsoft Defender reporting and bypass Person Account Management, Huntress really useful wiping and reimaging any confirmed contaminated machine from known-clean media moderately than cleansing it in place.
The agency urged directors to scrutinise any on-premises ScreenConnect deployments and to test ScreenConnect server audit logs for RunFiles or RanFiles entries exhibiting scripts executed from a “Visitor” course of, which it mentioned ought to be handled as an instantaneous crimson flag. Huntress cautioned that the precise filenames related to the marketing campaign could change over time, and that any surprising Home windows Script Host or PowerShell exercise tied to ScreenConnect classes ought to be investigated.
Huntress mentioned it’s in direct contact with ConnectWise, ScreenConnect’s maker, and continues to observe the exercise. The report features a full set of indicators of compromise, together with file hashes and command-and-control infrastructure, for defenders to test in opposition to their very own environments.
Distant monitoring and administration instruments like ScreenConnect have been among the many most abused classes of software program this yr, in line with Huntress, which has beforehand documented social-engineering campaigns utilizing the identical class of instrument to achieve preliminary entry to sufferer networks. What units this marketing campaign aside, researchers mentioned, is the addition of automated, worm-like propagation on prime of an already widespread assault vector.
