The order of operations decides what the mitigation buys. Huntress found that every incident it examined began with social engineering that put a rogue ScreenConnect instance on the victim's machine [5]. Deselecting TransferFiles does not touch that step. What it removes is the next one: modified clients executing 1.vbs through 4.vbs against endpoints that connect to them, which is where Huntress locates the worm-like spread across newly connected systems [8]. Read it as a propagation control rather than an entry control, and the guidance stops looking like a substitute for the patch.
Detection is cheap here. The rogue clients spawned repeated Windows Script Host processes, which Huntress flagged as abnormal behavior [6]. Persistence was a registry Run key named WindowsServiceHost pointing at a matching script in the affected user's AppData directory [7]. Inside ScreenConnect's own audit logs, Huntress says to look for RunFiles or RanFiles entries tied to a guest process [13]. Each of those is a hunt that runs against data an MSP already has.
The dates are the part to hold ConnectWise to. The advisory is dated September 3 and says a CVE identifier and an official fix will be issued within the week [2], which puts the fix due on or about September 10 [1]. The Help Net Security account of the advisory and the Huntress research is dated September 7 [17], four days into that window, with the role permission change still the published control [2].
What the material does not carry is scale. No victim count, no severity score, no CVE number, and no named operator behind the VBScript chain appear in either ConnectWise's advisory or the Huntress research as reported [3]. Huntress does place this inside a pattern rather than an isolated event: it calls RMM abuse a top attack vector it has tracked over the past year [16]. The staged design supports that read, with the scripts used for host profiling, concealment, and retrieving or launching further components [9].
The remediation cost lands downstream. Huntress recommends reimaging any machine already showing signs of compromise from known-good media [14], and the propagation model tells you which machines to check first: the ones that connected to a rogue instance after it landed. For a service provider, that list is customer endpoints, and it grows for as long as file transfer stays enabled on technician roles.
