ScreenConnect Compromise: Hackers Are Watching, Are You Ready? | Threat SnapShot

We know threat actors use RMM tools for command and control and to blend in with other legitimate activity in networks. But how about exploiting RMM tools for fun, profit, and remote code execution? In this week's Threat SnapShot, we'll look at two recent vulnerabilities in ConnectWise ScreenConnect (CVE-2024-1708 and CVE-2024-1709) an authentication bypass and directory traversal that can be combined together to achieve remote code execution. There are over 8,000 vulnerable versions exposed on the Internet, proof of concept exploits are available, and we're seeing evidence of exploitation activity now by threat actors. Patching should be done immediately, and ConnectWise is making the patches available even to customers outside their license's maintenance window, but in the meantime we'll discuss detection and hunting strategies to defend your organization.

References:
https://www.connectwise.com/company/t...
https://www.huntress.com/blog/a-catas...
https://www.huntress.com/blog/detecti...
https://cybir.com/2022/cve/hijacking-...
https://github.com/W01fh4cker/ScreenC...

SnapAttack Resources:
https://app.snapattack.com/collection... - Collection: ScreenConnect Compromise: Hackers Are Watching, Are You Ready? | Threat SnapShot
https://app.snapattack.com/threat/555... - Threat: ScreenConnect Authentication Bypass and Remote Code Execution
https://app.snapattack.com/detection/... - Detection: ScreenConnect Auth Bypass
https://app.snapattack.com/detection/... - Detection: ScreenConnect Extension Installed
https://app.snapattack.com/detection/... - Detection: Suspicious ScreenConnect Child Process
https://app.snapattack.com/detection/... - Detection: Possible ScreenConnect Webshell
https://app.snapattack.com/detection/... - Detection: CSC Net On The Fly Compilation
https://app.snapattack.com/detection/... - Detection: Suspicious ASP Temporary File
https://app.snapattack.com/detection/... - Detection: CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation
https://app.snapattack.com/detection/... - Detection: ScreenConnect User Database Modification
https://app.snapattack.com/detection/... - Detection: ScreenConnect User Database Modification - Security
https://app.snapattack.com/detection/... - Detection: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation
https://app.snapattack.com/detection/... - Detection: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security