Rogue ScreenConnect Clients Execute Four-Stage VBScript Chain Across Three Distinct Initial Access Vectors

Huntress documented three separate intrusions where ScreenConnect clients connected to distinct C2 endpoints at 45.13.237[.]190, 131.123.40[.]98, and borertors92.anondns[.]net. Each client immediately spawned wscript.exe to execute four staged VBS files staged in the temporary directory. The first script wrote a three-bit state value to value.txt after checking RAM, installed security products, and existing ScreenConnect instances. 2.vbs and 3.vbs waited for prior artifacts then retrieved Dropbox-hosted files that 4.vbs decrypted via runner.ps1 into AppData paths. Payload selection branched on the state bits: 000 and 001 produced additional ScreenConnect instances, 010 triggered UAC bypass tooling, and 011 delivered tunneling utilities plus a miner. Cleanup routines terminated wscript processes and removed staging files. The pattern indicates operators treat ScreenConnect as both initial foothold and persistent C2 channel rather than a one-time dropper. Similar abuse of legitimate remote-access tools has appeared in prior campaigns against MSP environments, yet the explicit EDR enumeration and state-machine logic here represent a refinement not previously detailed in public reporting on ScreenConnect misuse. Continued monitoring of the three observed C2 IPs and any newly registered domains resolving to the same infrastructure will reveal whether the operators expand the campaign or shift to new ScreenConnect instances.