Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress is tracking a pattern across multiple customer environments where rogue ScreenConnect clients repeatedly spawn the Windows Script Host to execute a series of four VBScript files.

≈