Hackers Exploit Remote‑Support Tool ScreenConnect to Deploy Worm‑Like Malware Across Windows Networks

Security researchers have identified a new attack chain that leverages compromised installations of the remote‑support software ScreenConnect, now known as ConnectWise Control, to disseminate malicious code across Windows machines. Unlike typical ransomware or phishing campaigns that rely on user interaction, the technique uses an infected remote‑access client to silently push staged payloads to any system it connects to, effectively turning a legitimate admin tool into a worm‑like conduit.

The abuse was first observed in early August when several enterprises reported unexpected lateral movement after a single endpoint was compromised. Analysts traced the activity to a modified ScreenConnect client that, once installed, establishes outbound connections to other hosts running the same remote‑support service. The malicious client then injects additional payloads—often backdoors or information‑stealers—into those hosts without requiring further user action.

Experts note that the method sidesteps many traditional defenses because the traffic originates from a trusted application already permitted through firewalls. The remote‑support software typically runs with elevated privileges, granting the malware the ability to execute code, modify system files, and maintain persistence. By piggybacking on legitimate remote sessions, the attackers can evade detection by security tools that focus on external threats.

While the precise motives of the threat actors remain unclear, the capability to rapidly propagate across an organization suggests a focus on espionage or data exfiltration rather than immediate financial gain. The lack of a lure—such as a phishing email—means the infection can spread silently once a single endpoint is breached, raising concerns for sectors that rely heavily on remote‑support tools, including IT services, healthcare, and education.

Mitigation steps recommended by cybersecurity firms include auditing all ScreenConnect installations, ensuring they are updated to the latest version, and disabling unnecessary remote‑access features. Organizations are also urged to implement strict network segmentation, enforce least‑privilege access for remote‑support accounts, and monitor for anomalous remote‑session activity. As remote‑work continues to drive the adoption of third‑party support tools, vigilance against such weaponized software becomes a critical component of broader cyber‑defense strategies.