[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDw-uvKrbPcaPv33NvyrftHtwpq-wNx2wq5jrNLnkCr0":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"85a487b5-aee5-427c-aa76-331f145f7154","Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns","hijacked-screenconnect-installs-are-spreading-malware-like-a-worm-huntress-warns-842f39","Cybersecurity firm Huntress has uncovered a wave of malicious installations of ScreenConnect, a widely used remote-support tool, that spread between machines without any further action from a victim or an attacker, a self-propagating attack chain researchers likened to a computer worm. In a blog post published this week, Huntress said its Security Operations Center (SOC) […] The post Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns appeared first on IT Security Guru.","Cybersecurity firm Huntress has identified a significant increase in malicious ScreenConnect installations. These compromised instances are capable of self-propagating malware across networks without further human intervention, exhibiting worm-like behavior. Researchers have likened this attack chain to a computer worm due to its autonomous spread.","Huntress warns of malicious ScreenConnect installations spreading malware like a worm.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F03\u002Fhijacked-screenconnect-installs-are-spreading-malware-like-a-worm-huntress-warns\u002F?utm_source=rss&utm_medium=rss&utm_campaign=hijacked-screenconnect-installs-are-spreading-malware-like-a-worm-huntress-warns",null,"2026-09-03T10:23:28+00:00","2026-09-03T18:00:35.39485+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"Huntress","vendor",{"name":24,"type":25},"remote-support tool","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":12,"name":28,"slug":29},"Malware","malware",[31,36,38],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":26,"icon":12,"name":28,"slug":29},{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":46,"vendors":131},[47,73,102],{"slug":48,"name":49,"problem":50,"products":51},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[52,60,65],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":61,"product_name":62,"url":63,"description":64},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":74,"name":75,"problem":76,"products":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":103,"name":104,"problem":105,"products":106},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[132],{"slug":133,"name":21,"logo_path":134,"roles":135},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":156},"hijacked-screenconnect-instances-spread-worm-like-malware-across-networks","Hijacked ScreenConnect Instances Spread Worm-Like Malware Across Networks","Attackers are exploiting compromised or malicious ScreenConnect remote access installations to autonomously propagate malware across enterprise networks without requiring further human interaction — behavior characteristic of a computer worm. The root cause stems from unpatched, misconfigured, or illegitimate ScreenConnect instances being left exposed and trusted within network environments. Because remote management tools inherently carry elevated trust and broad network access, a single compromised instance can serve as a launchpad to infect entire segments. This highlights the critical danger of poorly governed remote access tooling, which can bypass perimeter defenses entirely. Organizations that lack visibility into installed remote management software and fail to enforce network segmentation are especially vulnerable to rapid, lateral compromise.",[142,143,144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.AM-2: Software platforms and applications are inventoried","NIST CSF DE.CM-1: Network monitoring to detect potential cybersecurity events","MITRE ATT&CK T1072: Software Deployment Tools","MITRE ATT&CK T1021: Remote Services","MITRE ATT&CK T1210: Exploitation of Remote Services",{}]