Modified ScreenConnect Clients Used in Worm-Like Campaign

The attacks rely on backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients. The post Modified ScreenConnect Clients Used in Worm-Like Campaign appeared first on SecurityWeek .

Report facts: The campaign abuses backdoored ScreenConnect remote access instances to automatically transfer and execute malicious payloads on newly connected client systems, creating worm-like propagation through the remote management software supply path. This demonstrates that compromise of widely deployed remote tooling can be used as a high-leverage distribution vector for malware across many organizations. RealGround analysis: For environments where ScreenConnect or similar remote management tools integrate with AI systems or data pipelines, these backdoored clients represent an AI supply chain risk, as attackers could gain access to infrastructure hosting models or sensitive training/operational data. Organizations should harden and continuously audit remote-access software in their AI stack, maintain software bills of materials (SBOMs), and segment AI-related assets so that compromise of RMM tools cannot easily pivot into AI systems.