Threat actors are abusing legitimate remote-management tools, including ConnectWise ScreenConnect and Microsoft Quick Assist, to install persistent backdoors on Windows devices.
Huntress researchers identified several incidents in late August involving social-engineering lures, rogue ScreenConnect clients, VBScript payloads, and attempts to weaken endpoint defenses.
The campaigns affected unrelated organizations but followed a similar pattern. Victims were tricked into granting remote access or downloading a malicious ScreenConnect installer.
In one case, attackers posed as technical support staff and convinced a user to open Microsoft Quick Assist and share an access code. Another incident likely began with phishing, while a third used a fake Geek Squad refund lure.
After gaining access, the attackers installed unauthorized ScreenConnect clients that connected to command-and-control infrastructure.
Observed IP addresses included 45.13.237[.]190, 131.123.40[.]98, and 15.204.185[.]204. Researchers also observed the use of UltraViewer remote desktop software in one environment.
ScreenConnect Quick Assist Backdoors
The rogue ScreenConnect clients launched Windows Script Host (wscript.exe) to execute four VBScript files named 1.vbs, 2.vbs, 3.vbs, and 4.vbs.
The scripts formed a staged loader designed to profile the device, download encrypted payloads, decrypt them, and establish persistence.
The first script checked whether ScreenConnect was already installed, identified security tools such as CrowdStrike, SentinelOne, Sophos, Malwarebytes, Cisco AMP, and Huntress, and reviewed the device’s available RAM.
This profiling helped attackers choose a payload suited to the target system and possibly avoid analysis environments.
The second script downloaded and decoded a file called map.txt from Dropbox. This file contained links and decryption keys for later-stage payloads.
The third script selected a payload based on the victim’s system profile and downloaded it as an encrypted file.
Finally, 4.vbs created a PowerShell script named runner.ps1, launched it with an execution-policy bypass, and decrypted the final payload.
The attack then stored files in misleading Windows-related directories, executed additional PowerShell scripts, terminated script-host processes, and deleted staging files to reduce forensic evidence.
Attackers created a Registry Run key named WindowsServiceHost that launched WindowsServiceHost.vbs from the user’s AppData folder whenever the victim logged in.
This gives the attackers a persistent foothold even after the initial ScreenConnect session ends.
One recovered payload attempted a UAC bypass using ComputerDefaults.exe, disabled or bypassed security protections, added C:\Users as a Microsoft Defender exclusion, and installed a concealed ScreenConnect client.
The malware also removed uninstall information and restricted access to the malicious service, Huntress said.
Indicators of Compromise (IOCs)
| IOC Type | Indicator | Description |
|---|---|---|
| Malicious ScreenConnect ID | 7a4d7d66502d4260 | ScreenConnect client ID associated with the concealed persistent backdoor |
| Suspicious file | ScreenConnect.ClientSetup.msi |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
