[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGAI37r4zaT0TFPbJ5HCxOtfhtY-VzahQOehhf-b_ulk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"3b540e0d-2e9b-482a-85c5-8426accf263b","backdoored-screenconnect-clients-fuel-worm-like-attack-campaign","bebed31c-681c-4160-924a-790717da1dc9","Backdoored ScreenConnect Clients Fuel Worm-Like Attack Campaign","Attackers are exploiting a file transfer vulnerability in ScreenConnect remote access clients, using social engineering as the initial foothold to deploy rogue, backdoored instances on victim machines. Once installed, malicious VBScript payloads establish persistence and propagate laterally to other endpoints connected through the same tool — mimicking worm behavior. This campaign highlights the danger of trusted remote access software being weaponized, as legitimate tools often evade traditional security controls. The existence of an unpatched file transfer vulnerability further compounds the risk, giving attackers a reliable mechanism to spread without detection. Organizations relying on ScreenConnect must act immediately, as the self-propagating nature of this campaign can rapidly escalate a single compromise into an enterprise-wide incident.","**Immediate actions:**\n- Update all ScreenConnect clients to the latest patched version as soon as ConnectWise releases the official fix.\n- Audit all active ScreenConnect instances and terminate any unauthorized or unrecognized remote sessions immediately.\n- Block or quarantine endpoints exhibiting abnormal VBScript execution or unexpected outbound connections from ScreenConnect processes.\n\n**Long-term improvements:**\n- Enforce an allowlist policy so only IT-approved and centrally managed remote access tools can execute in your environment.\n- Implement application whitelisting to prevent unauthorized or modified versions of legitimate tools from running on endpoints.\n- Conduct regular security awareness training focused on social engineering tactics used to trick users into installing rogue remote access clients.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) rules to alert on ScreenConnect spawning scripting engines like VBScript or PowerShell.\n- Monitor network traffic for lateral movement patterns, including unusual peer-to-peer connections between managed endpoints.\n- Enable centralized logging of all remote access tool activity and route alerts to a SIEM for real-time correlation.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 IR-4: Incident Handling","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1059.005: Visual Basic (VBScript)","MITRE ATT&CK T1543: Create or Modify System Process (Persistence)",{},"published","2026-09-07T12:20:52.56163+00:00","2026-09-07T12:20:52.421+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Fmodified-screenconnect-clients-used-in-worm-like-campaign\u002F","modified-screenconnect-clients-used-in-worm-like-campaign-2fe084","Modified ScreenConnect Clients Used in Worm-Like Campaign",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"aaae3c33-bae5-4346-ab4f-f15537c317ae","2026-09-07","afternoon","ThreatNoir Afternoon Brief — September 7","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-07\u002Fthreatnoir-afternoon-brief-2026-09-07.mp3",[59,63,67],{"slug":60,"name":61,"problem":62},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":64,"name":65,"problem":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":68,"name":69,"problem":70},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]