Malware Exploits ConnectWise ScreenConnect for Distribution

Cybersecurity researchers have released details about a new malware activity that exploits ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) to newly connected systems. These activities were discovered by the security firm Huntress and exhibit worm-like behavior, spreading through various initial access vectors. The researchers identified three independent incidents that employed different methods for initial compromise. These include a Quick Assist technical support scam, a phishing-distributed MSI installer, and a fake access to remote desktop services. This variety of attack methods suggests a coordinated strategy to disseminate the malware.

The malware utilizes the remote desktop functionality of ConnectWise ScreenConnect to install itself on newly connected hosts. After the initial infection, the VBScript is executed, which then initiates further malicious activities. The researchers found that the malware is capable of self-replication and accessing other systems within the network. A key aspect of the malware is its ability to spread across different networks, complicating detection and mitigation efforts. The researchers observed that the malware can move within corporate networks by exploiting vulnerabilities in network security.

This could pose significant security risks for affected companies. The security firm has recommended that organizations check their systems for the latest security updates and ensure that all remote desktop services are properly configured. In particular, administrators should ensure that only authorized users have access to remote desktop services. Implementing multi-factor authentication could also help prevent unauthorized access. The researchers also noted that the malware is capable of infiltrating existing security solutions, making detection by conventional antivirus programs more difficult.

The use of behavioral analysis and advanced threat detection systems is recommended to identify and neutralize the malware early. The incidents documented by Huntress show that the malware can spread rapidly and remain active in various environments. The researchers have found that the malware has been detected in at least 10 different companies, indicating a widespread threat. The security community is urged to remain vigilant and keep track of the latest information regarding this threat.

Researchers from Huntress have announced plans for further analysis to better understand the malware's propagation patterns and develop appropriate countermeasures. The exact number of affected systems may rise in the coming weeks as more incidents are reported. The malware activities were first identified in September 2026, and researchers are working to assess the impact on the affected companies. The security situation remains tense as organizations continue to face the threat posed by this type of malware.