ConnectWise ScreenConnect flaw spreads malware via file transfers

ConnectWise confirmed the flaw impacts its popular remote support solution in a September 3 advisory, promising a CVE identifier and an official fix within the week. ScreenConnect is widely used by IT departments and managed service providers, supporting both ConnectWise-hosted cloud instances and self-hosted on-premise deployments.

How the Attack Actually Spreads

Cybersecurity firm Huntress detailed the full attack chain. Every incident began with social engineering, tricking a victim into installing a rogue ScreenConnect instance on their machine. From there, the compromised client spread malware to every new machine it connected to.

Huntress has tracked this pattern for the past year, noting that RMM abuse is a top attack vector among the incidents they respond to. Once deployed, the rogue clients spawned repeated Windows Script Host processes, dropping four VBScript files named 1.vbs through 4.vbs. Attackers also created a Windows registry Run Key called WindowsServiceHost, pointing to a matching script hidden in the user’s AppData directory.

Perhaps the most interesting part of the attack chain was that it used modified ScreenConnect clients to propagate the VBScript chain, Huntress researchers noted, describing the result as a worm-like spread across newly connected systems. The scripts performed system discovery and retrieved additional components, with payloads covering persistence, more ScreenConnect installations, tunneling, security control changes, and cryptocurrency mining.

What to Do Right Now

ConnectWise wrote that partners should disable file transfers for technicians immediately. Here’s how:

• Go to Administration, then Security, then Roles
• Edit each assigned role and review permissions for every session group
• If TransferFiles is enabled (or TransferFilesInSession on legacy versions), deselect it
• Apply this change to each applicable role

ConnectWise states this setting change does not require an upgrade and applies immediately. Huntress also advises checking ScreenConnect audit logs for RunFiles or RanFiles entries tied to a guest process, and recommends reimaging any compromised machine from known good media. We suggest admins apply extra scrutiny to any on-premises ScreenConnect installations, Huntress added.

Organizations relying on ScreenConnect should implement these mitigations now rather than waiting. ConnectWise has promised an official fix and CVE identifier within the week, but the current guidance stands until then.

Hashlytics Take

RMM tools like ScreenConnect are becoming a preferred attack vector for a simple reason: they’re already trusted and already have the access attackers want. A phishing email asking someone to install unfamiliar software raises flags. A remote support session, especially one that mimics a legitimate IT interaction, does not. What makes this particular flaw dangerous isn’t the exploit itself, it’s that the propagation method turns a single successful social engineering attempt into a self-spreading infection across every machine that trusts the compromised session. Any organization running ScreenConnect internally should treat the file transfer permission change as mandatory today, not as something to schedule for next week’s patch cycle.