Scenario library

Scenarios drawn from the last 18 months.

Each scenario ships with a timed inject chain, decision points, target departments and National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 mapping. Launch one to copy it into a new exercise for your organization.

Live advisoryAdvisory September 3, 2026 · Status as of September 8, 2026 · No CVE (Common Vulnerabilities and Exposures) entry yet

ScreenConnect file transfer and rogue remote-access clients

On September 3, 2026 ConnectWise disclosed a security issue in ScreenConnect file-transfer behavior across Remote Access, Support and Access sessions on Cloud and On-Premise deployments. The interim mitigation is to deselect the TransferFiles and TransferFilesInSession scoped permission for each technician role. ConnectWise said a CVE and a fixed version would follow within a week, so check the vendor advisory for the CVE and fixed version before you plan remediation. Separately, Huntress documented two incidents beginning August 20, 2026 and one on August 24, 2026, in which rogue ScreenConnect clients pushed a four-stage VBScript (Visual Basic Scripting Edition) chain to newly connected hosts, with worm-like spread. In each of those incidents users were tricked into installing rogue clients — a fake tech-support call, a phishing-delivered installer, and a fraudulent refund form. The vendor has not confirmed the disclosed file-transfer issue was used in those intrusions. Status as of September 8, 2026.

Auto-transfer and execution of malicious VBScript over remote sessions
Multi-stage VBScript/PowerShell recon, payload retrieval and decryption
Persistence via rogue installs, Run keys and WindowsServiceHost.vbs
User Account Control (UAC) bypass and disabling of Defender / Memory Integrity
Worm-like propagation to newly connected hosts

Open "Remote Hands" scenario Advisory sources