Backdoored ScreenConnect Clients Turn Remote‑Support Tool Into Worm‑Like Malware Distributor

Security researchers have uncovered a new threat campaign that weaponizes modified versions of the remote‑support utility ScreenConnect to spread malicious code across corporate networks. The operation, first reported by SecurityWeek, leverages backdoored ScreenConnect instances to hand off payloads to any client that later connects to the compromised server, effectively turning the legitimate tool into a conduit for a worm‑like infection.

ScreenConnect, rebranded as ConnectWise Control, is a widely deployed remote administration platform that allows IT staff to access and troubleshoot computers over the internet. Because the software is designed to traverse firewalls and establish encrypted sessions, it is often granted elevated network privileges and trusted status in many environments. This trust makes it an attractive target for threat actors seeking a stealthy foothold.

In the observed campaign, attackers first gain unauthorized access to a legitimate ScreenConnect server—typically through stolen credentials, exploitation of unpatched vulnerabilities, or by compromising a peripheral system. Once inside, they replace the standard client binaries with maliciously altered versions that retain the original functionality while embedding additional code capable of receiving and executing arbitrary payloads.

The malicious clients act as both receivers and distributors. When a new endpoint connects to the compromised server, the altered client automatically downloads the attacker‑controlled payload and executes it without user interaction. The newly infected endpoint then registers itself as a valid ScreenConnect client, extending the infection chain. This recursive behavior mirrors that of a worm, allowing the malicious code to propagate rapidly across any network that uses the tool.

The campaign raises significant concerns for organizations that rely on remote‑support solutions as part of their daily operations. Because ScreenConnect traffic is typically allowed through perimeter defenses, the malicious activity can evade conventional intrusion‑detection systems. Moreover, the use of a legitimate, signed binary complicates forensic analysis and may delay detection until the payload has already achieved a foothold.

Experts recommend several immediate mitigation steps. Administrators should verify the integrity of all ScreenConnect binaries against official checksums, apply the latest patches released by ConnectWise, and enforce multi‑factor authentication for all remote‑access accounts. Network monitoring should be enhanced to flag unexpected connections to known ScreenConnect endpoints, and any anomalous command‑execution activity should be investigated promptly.

As remote‑work and cloud‑based support tools become more prevalent, attackers are likely to continue targeting similar platforms. Ongoing collaboration between vendors, security researchers, and end‑users will be essential to harden these utilities against abuse and to limit the spread of worm‑like campaigns that exploit trusted software.