Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - ConnectWise ScreenConnect attacks deliver malware

This threat involves targeted attacks exploiting vulnerabilities in ConnectWise ScreenConnect, a widely used IT remote access and support tool. The attacks leverage publicly disclosed vulnerabilities identified as CVE-2024-1708 and CVE-2024-1709, which affect the public-facing application components of ScreenConnect. These vulnerabilities allow attackers to exploit the remote access platform without requiring prior authentication, aligning with the MITRE ATT&CK technique T1190, 'Exploit Public-Facing Application.' By exploiting these weaknesses, adversaries can deliver various malicious payloads into business environments, including malware such as ransomware, remote access trojans, or information stealers, as indicated by multiple malicious file hashes associated with the attacks. The lack of available patches for these vulnerabilities increases the risk exposure. Although no confirmed exploits in the wild have been reported yet, the critical nature of remote access tools and their privileged access within organizations make this a significant threat. The absence of specific affected versions suggests either multiple versions may be vulnerable or investigations are ongoing. The threat intelligence was sourced from the CIRCL OSINT Feed and analyzed by Sophos, highlighting ongoing monitoring efforts. Overall, this represents a medium-severity risk with the potential for substantial operational disruption and data compromise if exploited successfully.

Detailed information about OSINT - ConnectWise ScreenConnect attacks deliver malware. Get real-time updates, technical details, and mitigation strategies.

OSINT - ConnectWise ScreenConnect attacks deliver malware - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat involves active exploitation of vulnerabilities in ConnectWise ScreenConnect, a widely used IT remote access and support tool. Specifically, attackers are leveraging two recently disclosed vulnerabilities, CVE-2024-1708 and CVE-2024-1709, to compromise public-facing instances of ScreenConnect. These vulnerabilities allow threat actors to bypass authentication mechanisms or execute arbitrary code remotely, enabling them to deliver various malware payloads into targeted business environments. The attacks fall under the MITRE ATT&CK technique T1190, "Exploit Public-Facing Application," indicating that adversaries exploit weaknesses in externally accessible services to gain initial access. The campaign has been observed in the wild, with multiple malicious payloads identified by their hashes, confirming active exploitation. Notably, no patches are currently available for these vulnerabilities, increasing the risk for organizations that rely on ScreenConnect for remote management. The threat level is assessed as medium by the source, but the critical role of ScreenConnect in IT operations and the presence of known exploits amplify the potential impact. The attack vector targets remote access infrastructure, a high-value asset for adversaries seeking persistent access or lateral movement within networks. The technical analysis by CIRCL and Sophos highlights the sophistication and ongoing nature of these attacks, emphasizing the need for immediate mitigation and continuous monitoring.

Detailed information about OSINT - ConnectWise ScreenConnect attacks deliver malware affecting type osint. Get real-time updates, technical details, and mitigat

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:producer="sophos"'

Filter Threats

Threats Tagged 'misp-galaxy:producer="sophos"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility