ConnectWise ScreenConnect (versions below 26.6.5)

The software fails to properly verify whether a user has permission before allowing file transfers and execution during a remote session. Think of it like a hotel key card that opens any room on the floor rather than just your own — the system trusts the session without checking what that session is actually allowed to do.

Attackers used social engineering (manipulating people into trusting something malicious) to trick victims into running modified ScreenConnect clients. Once installed, the rogue client checked for active sessions and pushed four VBScript payload files to connected machines, establishing persistence and spreading further — worm-like behaviour that jumps from machine to machine without further human interaction.

1. Look for unexpected VBScript file creation or execution in system logs
2. Audit active ScreenConnect sessions for connections you did not initiate
3. Check for new scheduled tasks or startup entries added around August 20 onward

1. Upgrade ScreenConnect to version 26.6.5 immediately
2. As a temporary measure, disable the TransferFiles permission in ScreenConnect settings
3. Review session logs for signs of unauthorised file transfers since August 20