Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns
Brief
Cybersecurity firm Huntress has uncovered a wave of malicious installations of ScreenConnect, a widely used remote-support tool, that spread between machines without any further action from a victim or an attacker, a self-propagating attack chain researchers likened to a computer worm.
In a blog post published this week, Huntress said its Security Operations Center (SOC) had flagged the same unusual pattern of activity across several unrelated customer environments in late August.
Investigators later found the incidents were connected by a shared attack chain built around modified, or “rogue,” copies of ScreenConnect, a legitimate remote-access product made by ConnectWise that IT teams and help desks use to support end users remotely.
A familiar scam, an unfamiliar twist
Each incident Huntress examined began with social engineering.