MalwarePublished 23 Feb 2024

OSINT · ConnectWise ScreenConnect attacks deliver malware

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Mentions 2 CVEs

Mentioned vulnerabilities

Description

OSINT - ConnectWise ScreenConnect attacks deliver malware

Impact

European organizations face considerable risk due to the widespread use of ConnectWise ScreenConnect in IT service management and remote support across the continent. Successful exploitation could grant attackers unauthorized remote access, enabling deployment of malware that compromises confidentiality, integrity, and availability of critical systems. Potential impacts include data breaches exposing sensitive information, ransomware infections causing operational downtime, disruption of IT services, and lateral movement facilitating broader network compromise. The reliance on remote access tools for business continuity, especially in hybrid and remote work environments common in Europe, exacerbates the threat. Sectors with strict regulatory requirements such as finance, healthcare, and critical infrastructure may suffer legal and compliance consequences if sensitive data is exposed or systems are disrupted. The absence of patches prolongs vulnerability exposure, necessitating immediate mitigation to prevent exploitation. Although no active exploitation is confirmed, the potential impact on European organizations is significant, warranting heightened vigilance and proactive defense measures.

Defensive guidance

1. Implement strict network segmentation to isolate ConnectWise ScreenConnect servers from critical infrastructure and sensitive data repositories, limiting lateral movement opportunities if compromised. 2. Restrict external access to ScreenConnect instances by enforcing VPN usage or IP whitelisting to minimize exposure of the public-facing application. 3. Enforce multi-factor authentication (MFA) on all remote access tools, including ScreenConnect, to reduce the risk of unauthorized access even if vulnerabilities are exploited. 4. Continuously monitor network traffic and application logs for unusual activity related to ScreenConnect, such as unexpected connections or anomalous command execution, using advanced threat detection and SIEM solutions. 5. Conduct regular vulnerability scanning and penetration testing focused on remote access tools to proactively identify and remediate potential weaknesses. 6. Maintain an up-to-date inventory of all remote access solutions deployed and apply any available security updates or recommended workarounds from ConnectWise promptly. 7. Develop and rehearse incident response plans specifically addressing remote access compromise scenarios to enable rapid containment and recovery. 8. Educate IT support and security teams about the specific risks associated with ScreenConnect vulnerabilities and the indicators of compromise related to this threat. 9. Consider temporary deactivation or replacement of ScreenConnect instances where feasible until patches or mitigations are available.

Indicators of compromise

Hashes 3

2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a
a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0
c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f

Link 1

https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/

Text 6

ConnectWise ScreenConnect attacks deliver malware Multiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments
https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/
Blog
Malicious
Malicious
Malicious

Vulnerability 2

CVE-2024-1709
CVE-2024-1708

Community reviews

Loading reviews…