What: ConnectWise patched CVE-2026-84869 (CVSS 9.9) on September 8, 2026 — a flaw that lets a ScreenConnect client transfer and execute files across an active remote session without host authorisation or confirmation. CISA added it to the Known Exploited Vulnerabilities catalog on September 11 with an FCEB remediation deadline of September 14.
Who & when: Huntress observed in-the-wild exploitation from August 20, 2026 across three unrelated organisations, delivered by tech-support and refund-scam social engineering. The operators are unattributed but ran a single, consistent toolkit.
Why it matters: A modified client weaponises the flaw into worm-like propagation — it silently pushes a four-stage VBScript chain onto every newly connected host, then branches into a hidden ScreenConnect backdoor, a UAC-bypass elevation kit, or a wstunnel + XMRig package. Because ScreenConnect is a trusted RMM binary, the initial execution looks legitimate.
◈ Table of Contents
01 · Threat Overview & Timeline
PHASE 01ScreenConnect is one of the most widely deployed remote-support tools on Windows, which makes any authorisation weakness in it a high-value target. CVE-2026-84869 is not a server bug — it lives in the client, in how file-transfer actions are gated during a live session. Under the right conditions a session participant can drop and run files on the endpoint with no operator prompt and no host consent.
Huntress correlated the same tooling across multiple customer environments, and the tell-tale artefact — a legitimate-looking ScreenConnect client repeatedly spawning wscript.exe to run numbered VBScripts — was consistent enough to characterise the activity as a single campaign with worm-like behaviour.
| Field | Detail |
|---|---|
| CVE | CVE-2026-84869 Critical |
| CVSS 3.1 | 9.9 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CWE | CWE-862 (Missing Authorization) · CWE-269 (Improper Privilege Management) |
| Component | ScreenConnect client (server unaffected) |
| Vendor | ConnectWise |
| KEV added | September 11, 2026 (FCEB due September 14, 2026) |
- 1Aug 20, 2026 — First observed intrusions: Quick Assist tech-support scam and a phishing-delivered installer both terminate in a rogue ScreenConnect client.
- 2Aug 24, 2026 — A fake Geek Squad "refund" lure delivers the same client and VBScript chain to a third, unrelated organisation.
- 3Sep 2, 2026 — Huntress notes the staging Dropbox URL is offline, indicating active infrastructure rotation.
- 4Sep 8, 2026 — ConnectWise publishes the bulletin and ships the fix in ScreenConnect
26.6.5. - 5Sep 11, 2026 — CISA adds CVE-2026-84869 to the KEV catalog; federal patch deadline set for Sep 14.
02 · Affected Products & Versions
PHASE 02The vulnerable code path is in the client, but every client version prior to 26.6.5 is affected, including the access agents deployed by managed-service providers. Cloud-hosted instances receive the server-side update automatically, yet host clients and access agents still need to be reinstalled or updated to pick up the fix.
| Product | Affected | Fixed | Status |
|---|---|---|---|
| ScreenConnect client | All versions < 26.6.5 | 26.6.5 Patched | Actively exploited |
| ScreenConnect server | Not the vulnerable component | — | Not impacted |
| On-prem upgrade path | Requires 25.4 or later first | Then 26.6.5 | Manual |
| Cloud instances | Server auto-updated | 26.6.5 | Reinstall clients/agents |
Patching the server alone does not close the exposure. Any host client or access agent left on a pre-26.6.5 build remains exploitable, and an already-modified client will keep propagating regardless of the server version.
03 · Initial Access Vectors
PHASE 03Every observed intrusion began with human-operated social engineering rather than a remote network exploit. The attackers needed a foothold that would run a ScreenConnect client; once that client existed, the vulnerability handled the rest. The three documented entry points:
Quick Assist Scam
Victim is talked through opening Windows Quick Assist and granting remote control, after which the operator installs a rogue ScreenConnect client.
Phishing → Installer
An Edge-delivered download / MSI-style installer drops the client, in one case paired with a second RMM tool, UltraViewer, for redundancy.
Fake Refund Form
A Geek Squad "refund" lure walks the target into a support session that ends with the ScreenConnect client and VBScript chain in place.
All three lures share one property: they make the victim install a legitimately signed RMM binary themselves. That is why EDR often stays quiet at the initial-access stage — nothing is exploited yet, and the tool is trusted.
04 · The Vulnerability Mechanics
PHASE 04ScreenConnect supports a virtual file-transfer system so a technician can send files into a live session. CVE-2026-84869 is a missing-authorisation gap in that path: under certain circumstances a file-transfer action, including one flagged to Run, proceeds during an active session without host confirmation. A crafted or modified client can register files with the transfer system and issue a Run action that the endpoint honours automatically.
The critical forensic detail is who the execution is attributed to. In ScreenConnect audit logs, these file operations appear as RunFiles / RanFiles events, and in this campaign they run under Process: Guest — an unauthenticated session role that should never be pushing executable scripts.
| Property | Value |
|---|---|
| Bug class | Missing authorisation on in-session file transfer + run |
| Precondition | Active remote session with an attacker-controlled/modified client |
| User interaction | None required (no host confirmation prompt) |
| Audit-log signature | RunFiles / RanFiles executed from Process: Guest |
| Net effect | Arbitrary file write + execution on the endpoint |
05 · Technical Deep Dive: The Four-Stage VBScript Chain
PHASE 05Once the client runs the payload, the endpoint executes four numbered VBScripts — 1.vbs through 4.vbs — chained through a small on-disk state machine. Each stage does one job and hands a state value to the next, which keeps any single script benign-looking in isolation.
The first stage builds a three-bit state variable by profiling the host, then decides whether to continue. It aborts if a ScreenConnect client already exists (avoiding double-infection), enumerates security products, and checks for at least 5 GB of RAM to skip sandboxes and thin VMs.
- aExisting ScreenConnect install → abort if found.
- bSecurity tooling: Huntress, CrowdStrike, SentinelOne, Sophos, Malwarebytes, Cisco AMP.
- cPhysical memory ≥ 5 GB as a coarse anti-analysis gate.
- dWrites the resulting state to
%TEMP%\value.txt.
The second stage downloads a payload catalogue named map.txt from a Dropbox URL, then decodes it: base64 first, followed by a single-byte XOR using key 90. The decoded map tells later stages which encrypted blob corresponds to which state value.
The third stage reads the state written in stage one and downloads the matching encrypted payload named in the map — one of user.enc, acc.enc or combo.enc. This is where the chain forks into its three operational outcomes.
| State | Payload | Outcome |
|---|---|---|
| 000 / 001 | user.enc | User-level ScreenConnect backdoor |
| 010 | acc.enc | UAC-bypass / elevation kit (PyTorchFix.ps1) |
| 011 | combo.enc | wstunnel tunnel + XMRig miner |
The final stage fetches an AES key from a remote URI, builds an inline PowerShell script, and uses AES-CBC to decrypt the blob to %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip. It then runs the extracted PyTorchFix.ps1 and terminates the script processes to reduce noise.
The elevation payload is where the campaign turns a user-level foothold into a resilient, defence-blinding one. It chains a UAC bypass with AMSI tampering and Defender exclusions before installing a hidden ScreenConnect backdoor.
- 1Compiles Password.exe from inline C# at runtime.
- 2Hijacks the
ms-settings:protocol viaComputerDefaults.exefor a UAC bypass. - 3Sets
AmsiUtils.amsiInitFailed = trueto disable in-process AMSI scanning. - 4Adds
C:\Usersto Microsoft Defender exclusions. - 5Installs a hidden ScreenConnect client with instance ID
7a4d7d66502d4260.
A blanket Defender exclusion on C:\Users is a loud, high-fidelity signal. Alert on any process adding user-profile roots to exclusion lists — legitimate software almost never does this.
06 · Worm-Like Propagation
PHASE 06The behaviour that elevates this from "yet another RMM abuse" to a genuine worm is what the modified client does after it lands. It watches the ScreenConnect connection table and, when a new host joins, automatically weaponises the same flaw against it — no operator action required.
- 1The modified client monitors
EndPointStatusMessage.Connectionsfor new sessions. - 2It identifies a freshly connected Host by Connection ID.
- 3It packages
1.vbs–4.vbsas a file-transfer message with a Run action. - 4CVE-2026-84869 lets the transfer + run proceed without host confirmation.
- 5The new host re-runs the chain and, if it becomes a relay, repeats the loop.
This is why "rogue ScreenConnect installations across unrelated hosts" was the first clue: the spread pattern didn't match a single operator hand-jamming installs. It matched code fan-out.
07 · Post-Exploitation Payloads
PHASE 07Depending on the state value, the chain drops one of three toolsets. Together they give the operators persistence, elevation, covert tunnelling and monetisation from the same delivery framework.
user.zip — Backdoor
A user-level ScreenConnect backdoor for durable, low-privilege remote access that blends in with legitimate RMM traffic.
acc.zip — Elevation
PyTorchFix.ps1: UAC bypass, AMSI tampering, Defender exclusions, and a hidden client for SYSTEM-track persistence.
combo.zip — Tunnel + Miner
Themes.exe (a renamed wstunnel) for covert tunnelling, SearchIndex.exe (XMRig) for mining, plus a vulnerable WinRing0 driver.
| On-disk name | Real identity | Purpose |
|---|---|---|
| Password.exe | Inline C# tool | UAC bypass helper |
| Themes.exe | wstunnel | Covert tunnelling to homehub.opik[.]net:443 |
| SearchIndex.exe | XMRig | Monero cryptomining |
| svcdrv64.sys | WinRing0 driver | Vulnerable driver / low-level access |
| WindowsServiceHost.vbs | Loader script | Run-key persistence |
| Client 7a4d7d66502d4260 | ScreenConnect | Hidden backdoor instance |
08 · Indicators of Compromise
PHASE 08All indicators below are from Huntress incident data. Infrastructure has been rotating (the staging Dropbox URL went offline on Sep 2), so treat network IOCs as point-in-time and prioritise the behavioural detections in Phase 09.
| File | SHA-256 |
|---|---|
| 1.vbs | 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020 |
| 2.vbs | de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 |
| 2.vbs (v2) | 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260 |
| 3.vbs | 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66 |
| 4.vbs | de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede |
| WindowsServiceHost.vbs | ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de |
| Indicator | Role |
|---|---|
| 45.13.237[.]190 | C2 |
| 131.123.40[.]98:8041 | ScreenConnect C2 |
| 15.204.185[.]204 | C2 |
| 146.59.55[.]107 | UltraViewer (secondary RMM) |
| 45.32.192[.]150 | UltraViewer (secondary RMM) |
| tele-sync.opik[.]net | Domain (assoc. 45.13.237[.]190) |
| borertors92.anondns[.]net | ScreenConnect C2 domain |
| homehub.opik[.]net:443 | wstunnel tunnelling endpoint |
| Type | Value |
|---|---|
| State file | %TEMP%\value.txt |
| Payload map | %TEMP%\map.txt |
| Encrypted blob | %TEMP%\out.enc |
| Decryptor | %TEMP%\runner.ps1 |
| Decrypted payload | %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip |
| VBS distribution dir | C:\Users\Public\Libraries\Default\Lib\Lib1\ |
| Persistence script | %APPDATA%\WindowsServiceHost.vbs |
| Run key | HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost |
09 · Detection & Hunt Queries
PHASE 09The most durable signal is behavioural: a signed ScreenConnect client spawning the Windows Script Host to run numbered VBScripts. Each query below pairs a Microsoft Sentinel / Defender KQL with a Splunk SPL equivalent, and each is preceded by what it catches.
DETECTS — ScreenConnect client spawning wscript.exe (core behavioural tell)
DETECTS — WindowsServiceHost Run-key persistence
DETECTS — Defender exclusion added for C:\Users (evasion)
DETECTS — outbound C2 / tunnel connections
ScreenConnect keeps its own audit trail. Hunt the session logs for RunFiles / RanFiles entries referencing 1.vbs–4.vbs executed from Process: Guest — that combination is a near-certain compromise signal, independent of EDR coverage.
10 · MITRE ATT&CK Mapping
PHASE 10| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Phishing: Spearphishing Link | T1566.002 |
| Execution | Command & Scripting: VBScript | T1059.005 |
| Execution | Command & Scripting: PowerShell | T1059.001 |
| Persistence | Registry Run Keys / Startup Folder | T1547.001 |
| Priv. Escalation | Abuse Elevation Control: Bypass UAC | T1548.002 |
| Defense Evasion | Impair Defenses: Disable/Modify Tools | T1562.001 |
| Defense Evasion | Deobfuscate/Decode (base64+XOR+AES) | T1140 |
| Defense Evasion | Obfuscated / renamed tools | T1027 |
| Discovery | Security Software Discovery | T1518.001 |
| Command & Control | Ingress Tool Transfer | T1105 |
| Lateral Movement | Lateral Tool Transfer (worm) | T1570 |
| Impact | Resource Hijacking (XMRig) | T1496 |
11 · Mitigation & Hardening
PHASE 11- 1Upgrade to ScreenConnect 26.6.5 on server, host clients and access agents (on-prem must be on 25.4+ first).
- 2If you cannot patch immediately, deselect the
TransferFilespermission under Administration → Security → Roles as a temporary mitigation. - 3Audit all installed ScreenConnect instances; hunt for the hidden client ID
7a4d7d66502d4260and any instance you did not deploy. - 4Inventory RMM tools org-wide — the presence of a second tool such as UltraViewer alongside ScreenConnect is a strong compromise indicator.
- 5Sweep for the Run key
WindowsServiceHostand the artefact paths in Phase 08.
Huntress advised that confirmed-compromised hosts be reimaged from known-good media. Between UAC bypass, AMSI tampering, Defender exclusions and a vulnerable driver, in-place cleanup is unreliable.
- All ScreenConnect binaries confirmed at 26.6.5 or later
- No unauthorised ScreenConnect instances or UltraViewer present
- WindowsServiceHost Run key and VBS artefacts removed / host reimaged
- Defender exclusions reset; AMSI functioning; C2 IOCs blocked at egress
- RMM install permitted only via application allow-listing going forward
Longer term, treat RMM binaries as high-risk: restrict who can install them with application control, alert on any RMM tool spawning a scripting host, and require host-side confirmation for in-session file transfers wherever the product supports it.
12 · Sources & References
PHASE 12Check your environment against these IOCs.
Paste the ScreenConnect hashes, C2 IPs and domains from Phase 08 into the CyberHawk IOC Scanner, and browse more active-exploitation breakdowns on the Threat Intel feed. For RMM-abuse response playbooks, see the CyberHawk SOP library.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."