Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label trojans. Show all posts
trojans
ConnectWise ScreenConnect malware Huntress Huntress cybersecurity IT department LockBit malware trojans

Hackers Turn ScreenConnect Into Its Own Infection Vector in New Worm-Like Campaign

 



A remote access tool built for IT departments and help desks is now being weaponized against them. Researchers at Huntress say they've found hacked versions of ConnectWise's ScreenConnect software that don't just give attackers a foothold on one machine, they use that foothold to infect whoever connects to it next, turning a single compromised endpoint into a launching pad for further attacks.

Huntress said its Security Operations Center issued three critical incident alerts in late August after spotting the same unusual pattern across customer networks that had nothing else in common. In each case, a rogue ScreenConnect client had been planted through social engineering, and once running, it began quietly automating an infection chain that most victims never saw coming.


Three break-ins, one playbook

The entry points varied, but the outcome didn't. On August 20, Huntress caught a case that started with a classic tech support scam: someone called a victim claiming their computer had been hacked, then walked them through opening Quick Assist, the remote help tool that ships with Windows, and handing over control. Once inside, the attacker installed a ScreenConnect client wired to call home to a server at 45.13.237[.]190, an address that VirusTotal had tied to a domain called tele-sync.opik[.]net earlier that same month.

A second incident, logged the same day, took a different path in. The victim ran a file called ScreenConnect.ClientSetup.msi straight out of a Microsoft Edge downloads folder, almost certainly after clicking through a phishing email. That installer set up a client pointed at a separate server, 131.123.40[.]98, over port 8041. Huntress later found the same machine reaching out to several more IP addresses tied to the campaign's infrastructure.

The third case, on August 24, started with something almost mundane: a person searching online for a Geek Squad refund form. Instead of a form, they got a rogue ScreenConnect.Client.exe that connected back to a domain named borertors92.anondns[.]net. Huntress shut this one down quickly enough that it never progressed past the initial script execution.

Different bait, same result. Once the ScreenConnect client landed on a machine, it began repeatedly calling wscript.exe, the built-in Windows scripting engine, to fire off four files named, plainly, 1.vbs, 2.vbs, 3.vbs and 4.vbs.


What the four scripts actually do

Huntress pulled the scripts apart and found a loader designed to feel its way around a system before deciding what to drop on it.

The first script checks whether ScreenConnect is already installed, looks for security software including Huntress's own agent, CrowdStrike, SentinelOne, Sophos, Malwarebytes and Cisco AMP, and checks how much memory the machine has, likely a crude way of ruling out sandboxes and virtual machines used by researchers. It boils all of that down into a three-digit code and drops it into a file called value.txt in the Windows temp folder.

The second script waits for that file to appear, then fetches a link from Dropbox, decodes it and stores the result as a lookup table. Each possible three-digit combination in that table maps to a different payload and a different AES decryption key. The third script reads the table, matches it against the code generated earlier, and downloads whichever payload fits. The fourth script grabs the matching decryption key, builds a PowerShell script from scratch inside the VBScript itself, and runs it with Windows' script execution safeguards switched off.

That PowerShell script does the actual unwrapping, decrypting the downloaded file and handing control to a second, more capable PowerShell script that Huntress found renamed as PyTorchFix.ps1. Depending on which of the three outcomes the profiling scripts settled on, the victim ends up with either a bare-bones backdoored ScreenConnect client, a version bundled with tools for privilege escalation and persistence, or the full package: tunneling software and a cryptocurrency miner thrown in as well.

One small detail stood out to the researchers. A comment buried in the third script spells out the payload table's format in plain, tutorial-style language, the kind of explanatory note that reads less like something a human attacker jotted down and more like something an AI coding tool generated on the fly.


How the infection spreads on its own

This is the part that makes the campaign unusual. Buried in the backdoored ScreenConnect client is code that watches ScreenConnect's own connection list for new sessions. The moment somebody new connects, whether that's another victim, a technician, or anyone else routed through the same infrastructure, the client repackages all four VBScript files, hands them to ScreenConnect's built-in file transfer feature, flags them to run automatically, and pushes them straight to the new arrival.

Huntress described it as the modified client using the server's own connection status data to figure out who just showed up, then quietly loading them up with the same infection. The client keeps a short memory of which sessions it has already hit so it doesn't repeat itself mid-session, but that memory resets once someone disconnects, meaning a second visit from the same person can trigger the whole thing over again.

The heavier version of the payload came with extras: a copy of the tunneling tool wstunnel disguised under the filename Themes.exe, reaching out to homehub.opik[.]net over port 443; an XMRig cryptocurrency miner renamed SearchIndex.exe; and a known vulnerable driver called WinRing0, saved as svcdrv64.sys, which attackers commonly use to get code running with elevated privileges. The malware also went after Windows Defender directly, disabling its reporting and notifications and switching off a hardware-level protection called Hypervisor-Protected Code Integrity. In at least one case, the attackers also dropped a second remote access tool, UltraViewer, apparently as a fallback in case ScreenConnect got pulled.

Huntress caught and stopped all three original incidents before the attackers finished the job, but the firm says it has continued to see the same pattern show up elsewhere since. Because the malware digs in so deep, wiping the affected machines and rebuilding them from clean media is what Huntress is telling customers to do rather than trying to clean an infected system in place.


Where ConnectWise fits in, and where it doesn't

Huntress says it's been talking with ConnectWise throughout the investigation, and on September 3, ConnectWise published its own advisory describing a problem with file transfer behavior in ScreenConnect's Remote Access, Support and Access sessions, affecting both the cloud-hosted version and self-hosted, on-premises deployments.

The company said a CVE number and an official patch are coming within the week. In the meantime, it's telling ScreenConnect administrators to go into Administration, then Security, then Roles, and check whether the TransferFiles permission, called TransferFilesInSession in older builds, is switched on for any assigned role. If it is, ConnectWise says to turn it off, a change that doesn't require updating ScreenConnect itself and can be applied right away.

One thing worth being precise about: ConnectWise has not said the file transfer issue is technically the same vulnerability the Huntress campaign is exploiting. The advisory and the Huntress research came out around the same time and clearly describe related territory, file transfer abuse inside ScreenConnect sessions, but the company has stopped short of confirming a direct link between the two.

Huntress, for its part, is telling anyone running ScreenConnect on-premises to take a closer look at their deployments regardless. The firm recommends digging through ScreenConnect's server-side audit logs for RunFiles or RanFiles entries tied to a Guest process, especially any referencing unfamiliar VBScript or PowerShell activity, and treating that as an immediate red flag. Huntress also cautioned that the exact filenames tied to this campaign will likely change as the attackers adjust, so the underlying behavior, scripted execution launched through a ScreenConnect session, matters more than the specific file names.


Not the first time ScreenConnect has been a target

This isn't ScreenConnect's first brush with mass exploitation. In February 2024, ConnectWise disclosed a pair of vulnerabilities in the product, an authentication bypass rated a perfect 10 on the CVSS scale and a path traversal flaw alongside it, that let attackers create administrator accounts on exposed servers without needing valid credentials. Proof-of-concept code for those bugs went public within days, and Huntress's own CEO at the time called it the makings of what could be the biggest cybersecurity incident of that year, given that a single exploited server could hand attackers control over thousands of downstream endpoints managed through it.

What followed was a scramble. Security vendors including Sophos and Darktrace tracked ransomware built from a leaked LockBit builder tool being dropped through the exploited servers, alongside Cobalt Strike beacons and remote access trojans. The Cybersecurity and Infrastructure Security Agency later added one of the two flaws to its Known Exploited Vulnerabilities catalog. More recently, other research teams have logged waves of signed ScreenConnect droppers used in financial sector phishing campaigns, and industry researchers have generally flagged remote monitoring and management software as one of the more consistently abused categories of legitimate IT tooling over the past couple of years, precisely because it's designed to do the thing attackers want: get full control of a machine without tripping the alarms a piece of unfamiliar malware would.


The current campaign fits that same pattern in terms of how attackers get in, but the automated, self-spreading distribution mechanism built into the client itself is new territory, and it's the detail that has researchers paying closer attention this time around.

Read more »
virus
Antivirus malware ransomware spyware trojans virus

Virus, Malware, or Spyware? Here’s What They Really Mean

 




Many people casually refer to every cyber threat as a “virus,” but cybersecurity professionals use a much broader classification system. A security program that only defended against traditional computer viruses would offer very limited protection today because viruses represent just one form of malicious software. Modern antivirus platforms are designed to detect and block many different categories of malware, including ransomware, spyware, trojans, credential stealers, rootkits, and bot-driven attacks.

Traditional computer viruses have also become less common than they once were. Most modern cybercriminal groups are financially motivated and prefer attacks that generate revenue rather than simple disruption or digital vandalism. Spyware operators profit from stolen personal information, banking trojans attempt to drain financial accounts directly, and ransomware gangs demand cryptocurrency payments from victims in exchange for restoring encrypted files. Because current security tools already defend against a wide range of malicious software, most users do not usually need to distinguish one malware family from another during day-to-day use.

At the same time, understanding these terms still matters. News reports about cyberattacks, data breaches, espionage campaigns, and ransomware incidents often contain technical language that can confuse readers unfamiliar with cybersecurity terminology. Knowing how different forms of malware behave makes it easier to understand how attacks spread, what damage they cause, and why security researchers classify them differently.

A traditional virus spreads when a user unknowingly launches an infected application or boots a compromised storage device such as a USB drive. Viruses generally try to remain unnoticed because their ability to spread depends on avoiding detection long enough to infect additional files, programs, or devices. In many cases, the malicious payload activates only after a specific date, time, or triggering condition. Earlier generations of viruses often focused on deleting files, corrupting systems, or displaying disruptive messages for attention. Modern variants are more likely to steal information quietly or help conduct distributed denial-of-service attacks that overwhelm online services with massive volumes of internet traffic.

Worms share some similarities with viruses but spread differently because they do not necessarily require users to open infected files. Instead, worms automatically replicate themselves across connected systems and networks. One of the earliest examples, the Morris worm of 1988, was originally intended as an experiment to measure the size of the developing internet. However, its aggressive self-replication consumed enormous amounts of bandwidth and disrupted numerous systems despite not being intentionally designed to cause widespread destruction.

Trojan malware takes its name from the ancient Greek story of the Trojan Horse because it disguises malicious code inside software that appears safe or useful. A trojan may present itself as a game, utility, browser tool, mobile application, or software installer while secretly performing harmful actions in the background. These threats often spread when users unknowingly download, share, or install infected files. Banking trojans are particularly dangerous because they can manipulate online financial transactions or steal login credentials directly. Other trojans harvest personal information that can later be sold through underground cybercrime marketplaces.

Some malware categories are defined less by how they spread and more by what they are designed to do. Spyware, for example, focuses on monitoring victims and collecting sensitive information without consent. These programs may capture passwords, browsing histories, financial information, or login credentials. More invasive forms of spyware can activate webcams or microphones to observe victims directly. A related category known as stalkerware is frequently installed on smartphones to monitor calls, messages, locations, and online activity. Because surveillance-focused malware has become increasingly common, many modern security products now include dedicated spyware protection features.

Adware primarily generates unwanted advertisements on infected devices. In some cases, these advertisements are targeted using data gathered through spyware-related tracking techniques. Aggressive adware infections can become so intrusive that they interfere with normal computer use by flooding browsers, redirecting searches, or constantly displaying pop-up windows.

Rootkits are designed to hide malicious activity from operating systems and security software. They manipulate how the system reports files, processes, or registry information so infected components remain invisible during scans. When security software requests a list of files or registry entries, the rootkit can alter the response before it is displayed, effectively concealing the malware’s presence from the user and from defensive tools.

Bot malware usually operates silently in the background and may not visibly damage a computer at first. Instead, infected devices become part of remotely controlled botnets managed by attackers sometimes referred to as bot herders. Once connected to the botnet, systems can receive commands to send spam emails, participate in coordinated cyberattacks, or overwhelm websites with malicious traffic. This arrangement also helps attackers hide their own infrastructure behind thousands of compromised machines.

Cryptojacking malware secretly hijacks a device’s processing power to mine cryptocurrencies such as Bitcoin. Although these infections may not directly destroy data, they can severely slow systems, increase electricity usage, drain battery life, and contribute to overheating problems because of constant processor strain.

The malware ecosystem also includes droppers, which are small programs designed specifically to install additional malicious software onto infected systems. Droppers often operate quietly to avoid attracting attention while continuously delivering new malware payloads. Some receive instructions remotely from attackers regarding which malicious programs should be installed. Cybercriminal operators running these distribution systems may even receive payment from other malware developers for spreading their software.

Ransomware remains one of the most financially damaging forms of cybercrime. In most attacks, the malware encrypts documents, databases, or entire systems and demands payment in exchange for a decryption key. Security software is generally expected to detect ransomware alongside other malware categories, but many cybersecurity professionals still recommend additional dedicated ransomware defenses because the consequences of missing a single attack can be devastating. Hospitals, schools, businesses, and government organizations around the world have all experienced major operational disruptions linked to ransomware campaigns.

Not every program claiming to improve cybersecurity protection is legitimate. Fake antivirus products, commonly called scareware, are designed to frighten users with fabricated infection warnings and pressure them into paying for unnecessary or malicious software. At best, these programs provide no meaningful protection. At worst, they introduce additional security risks or steal financial information entered during payment. Many scareware campaigns rely on alarming pop-ups and fake scan results to manipulate victims psychologically.

Identifying fake security products has become increasingly difficult because many now imitate legitimate software convincingly. Cybersecurity experts generally recommend checking trusted reviews and downloading security tools only from reputable vendors or established sources. Fraudulent review websites also exist, making careful verification especially important before installing security software.

Modern malware rarely fits neatly into a single category. One malicious program may spread like a virus, steal information like spyware, and hide itself using rootkit techniques simultaneously. Likewise, modern security solutions rely on multiple defensive layers rather than antivirus scanning alone. Comprehensive security suites may include firewalls that block network-based attacks, spam filters that intercept malicious email attachments, phishing protection systems, and virtual private networks that help secure internet traffic. Some VPN services, however, restrict advanced features behind additional subscription payments.

The term “malware” ultimately serves as a broad label covering every type of software intentionally created to harm systems, steal information, spy on users, disrupt operations, or provide unauthorized access. Industry organizations such as Anti-Malware Testing Standards Organization often prefer the term “anti-malware” because it reflects the wider range of threats modern security tools must address. However, most consumers remain more familiar with the word “antivirus,” which continues to dominate the industry despite the changing nature of cyber threats.

Understanding these distinctions does not require becoming a cybersecurity specialist, but it does help people recognize how varied modern digital threats have become. From ransomware and spyware to botnets and credential-stealing trojans, malicious software now exists in many different forms, each designed for a specific purpose within the broader cybercrime economy.

Read more »
Subscribe to: Posts (Atom)