ScreenConnect worm: disable file transfer today

There is no CVE for this yet and no patch. Huntress found rogue ScreenConnect clients that push a malware chain to every new machine that connects to them, which makes ordinary remote support sessions the transport. ConnectWise confirmed the file transfer behavior affects both Cloud and On-Premise deployments and told administrators to turn the permission off while it builds a fix. If your IT provider uses ScreenConnect, that is a question for this morning.

What actually happened

Huntress documented three separate incidents at unrelated organizations in late August 2026. Every one started with social engineering, not an exploit: a fake Quick Assist support session, a phishing email carrying ScreenConnect.ClientSetup.msi, and a fraudulent Geek Squad refund page that talked a victim into launching a rogue client.

Once a modified client is running, it stages four VBScript files — 1.vbs through 4.vbs — and uses ScreenConnect's own file-transfer feature to push and run them on newly connected endpoints. That is the worm-like part. The chain profiles the host (it checks for Huntress, CrowdStrike, SentinelOne and Sophos, and whether RAM exceeds 5GB), pulls an XOR-and-base64 encoded config from Dropbox, downloads AES-encrypted payloads, and executes PyTorchFix.ps1 for privilege escalation and persistence. Persistence lands in HKCU\Software\Microsoft\Windows\CurrentVersion\Run under the value name WindowsServiceHost.

The payloads are exactly as unglamorous as you would expect: Themes.exe is a renamed wstunnel for tunneling out, SearchIndex.exe is the XMRig crypto miner, and svcdrv64.sys is the vulnerable WinRing0 driver used to get kernel-level reach. Plus another ScreenConnect install, so the access survives cleanup of the first one.

ConnectWise published its advisory on September 3 and said a CVE identifier and an official fix would follow within the week.

Why this matters for your business

You do not need to run ScreenConnect for this to be your problem. You need someone with remote access to your machines to run it. That is most managed IT.

The mitigation requires no upgrade. In the ScreenConnect admin console: Administration > Security > Roles, edit each role, and in Scoped Permissions deselect TransferFiles (or TransferFilesInSession on legacy builds) for every session group. Technicians lose drag-and-drop file transfer. That is the trade, and this week it is a good one.

For detection, Huntress says to search ScreenConnect server audit logs for RunFiles or RanFiles entries where the process is Guest. A hit there means a session ran something on the endpoint, and Huntress's guidance for a confirmed host is reimage from known-good media, not clean and hope.

This is the second RMM story in two days — N-able N-central shipped a CVSS 10.0 pre-auth RCE hotfix yesterday. Different vendor, same structural fact: the console that supports your fleet also owns it. Ask your provider which product they use, whether file transfer is disabled today, and what their audit logs show for the last three weeks.

Sources: Huntress: Rogue ScreenConnect Installations, Help Net Security, BleepingComputer.