#ParsedReport #CompletenessMedium
03-09-2026

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

https://www.huntress.com/blog/rogue-screenconnect-installations

Report completeness: Medium

Threats:
Screenconnect_tool
Ultraviewer_tool
Microsoft_quick_assist_tool
Tech-support-scam_kit_tool
Edr-killer
Uac_bypass_technique
Amsi_bypass_technique
Wstunnel_tool
Xmrig_miner
Deathransom

Victims:
Organizations, Windows endpoints

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027.004, T1027.013, T1036, T1059.001, T1059.003, T1059.005, T1070.004, T1082, T1083, T1090, have more...

IOCs:
File: 24
IP: 5
Domain: 3
Path: 2
Registry: 1
Hash: 6

Soft:
Microsoft Defender, Microsoft Edge, Windows Registry, Dropbox, Windows service, Windows Defender

Algorithms:
aes-cbc, sha256, base64, xor, aes

Languages:
powershell, vbscript