Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress, Wednesday, September 9th, 2026
Rogue ScreenConnect clients repeatedly spawn Windows Script Host to run VBScript files across unrelated environments.
Huntress tracked rogue ConnectWise ScreenConnect clients appearing across unrelated customer environments, repeatedly spawning Windows Script Host to execute multiple VBScript files.
The pattern across unconnected organizations suggests worm-like propagation rather than separate intrusions.
ScreenConnect is a recurring target because it is legitimate remote access software, so its presence raises no alarm and it inherits the trust granted to management tooling.
The post includes the behavioral indicators that distinguish rogue instances from sanctioned deployments, which is the practical detection problem.