Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

A sophisticated, worm-like attack is abusing rogue ScreenConnect installations to automatically spread multi-stage VBScript payloads across unrelated organizations, enabling persistent remote access, evasion, and even cryptomining, while leveraging legitimate RMM tools and exploiting file transfer features.