Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns
Huntress warns of malicious ScreenConnect installations spreading malware like a worm.
Cybersecurity firm Huntress has identified a significant increase in malicious ScreenConnect installations. These compromised instances are capable of self-propagating malware across networks without further human intervention, exhibiting worm-like behavior. Researchers have likened this attack chain to a computer worm due to its autonomous spread.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Huntress?
Get an email when a new story names Huntress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are exploiting compromised or malicious ScreenConnect remote access installations to autonomously propagate malware across enterprise networks without requiring further human interaction — behavior characteristic of a computer worm. The root cause stems from unpatched, misconfigured, or illegitimate ScreenConnect instances being left exposed and trusted within network environments. Because remote management tools inherently carry elevated trust and broad network access, a single compromised instance can serve as a launchpad to infect entire segments. This highlights the critical danger of poorly governed remote access tooling, which can bypass perimeter defenses entirely. Organizations that lack visibility into installed remote management software and fail to enforce network segmentation are especially vulnerable to rapid, lateral compromise.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.