Full Report
Adversaries have been VERY busy in the wake of the ScreenConnect vulnerabilities (CVE-2024-1709 & CVE-2024-1708). Here’s all the post-exploitation details, tradecraft, and tactics we’ve observed so far!
Analysis Summary
# Incident Report: SlashAndGrab - ScreenConnect Post-Exploitation
## Executive Summary
Multiple threat actors exploited critical vulnerabilities in ConnectWise ScreenConnect (CVE-2024-1709 and CVE-2024-1708) to bypass authentication and achieve remote code execution. The impact was widespread, involving the deployment of ransomware (including LockBit 3.0 variants), cryptocurrency miners, and various persistence mechanisms across numerous industries. Huntress managed to disrupt several of these attacks through active SOC monitoring and immediate eviction of adversaries.
## Incident Details
- **Discovery Date:** February 19, 2024
- **Incident Date:** February 2024 (Ongoing exploitation)
- **Affected Organization:** Multiple (Global ScreenConnect user base)
- **Sector:** Cross-sector (MSPs, Healthcare, Finance, and Critical Infrastructure)
- **Geography:** Worldwide
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing approximately February 19-20, 2024
- **Vector:** Authentication Bypass (CVE-2024-1709) and Path Traversal (CVE-2024-1708)
- **Details:** Attackers exploited a flaw in the ScreenConnect Setup Wizard to create unauthorized administrative accounts, allowing full control over the management console.
### Lateral Movement
- Adversaries used the ScreenConnect agent's built-in "Command" and "File Transfer" features to push malicious scripts and executables to managed endpoints.
### Data Exfiltration/Impact
- **Ransomware:** Deployment of LockBit 3.0 (LB3.exe) and other encryptors (upd.exe, svchost.exe).
- **Resource Hijacking:** Installation of XMRig and other Monero cryptocurrency miners.
- **Unauthorized Access:** Creation of new local users for persistent backdoor access.
### Detection & Response
- **Detection:** Huntress SOC identified suspicious administrative account creation and atypical process execution spawning from `ScreenConnect.Service.exe`.
- **Response:** Automated and manual isolation of compromised hosts, revocation of unauthorized credentials, and patching of the ScreenConnect software.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2024-1709 (Auth Bypass) via the /SetupWizard.aspx endpoint.
- **Persistence:** Creation of new local/domain admin accounts; installation of additional RMM tools (AnyDesk, Atera).
- **Privilege Escalation:** Inherited SYSTEM privileges via the ScreenConnect service execution.
- **Defense Evasion:** Renaming malicious binaries to masquerade as legitimate Windows services (e.g., `svchost.exe`).
- **Credential Access:** Potential dumping of local SAM databases and LSASS (implied by the use of Cobalt Strike and ransomware prep).
- **Discovery:** Local system and network enumeration using built-in Windows commands via the ScreenConnect console.
- **Lateral Movement:** Command execution across all endpoints managed by the compromised ScreenConnect instance.
- **Collection:** Staging of sensitive data prior to ransomware deployment.
- **Exfiltration:** Transfer of data via encrypted channels (observed in Cobalt Strike beacons).
- **Impact:** Encryption of files (Ransomware) and unauthorized use of CPU resources (Crypto-mining).
## Impact Assessment
- **Financial:** High potential costs related to ransom demands, recovery services, and lost productivity.
- **Data Breach:** Risk of sensitive data exfiltration prior to encryption.
- **Operational:** Significant disruption for MSPs and their downstream clients due to locked systems.
- **Reputational:** High impact for service providers responsible for managing client security.
## Indicators of Compromise
- **Network:**
- `155.94.209[.]27`
- `155.94.209[.]12`
- **Files:**
- `LB3.exe` (LockBit 3.0 variant)
- `upd.exe`
- `svchost.exe` (Non-standard paths)
- **Behavioral:**
- Creation of user accounts via `ScreenConnect.Service.exe`.
- Execution of PowerShell commands to download `.exe` or `.msi` files from external IPs.
## Response Actions
- **Containment:** Terminating unauthorized ScreenConnect sessions and isolating affected endpoints.
- **Eradication:** Deleting malicious binaries, removing unauthorized user accounts, and patching ScreenConnect to version 23.9.8+.
- **Recovery:** Restoring systems from backups where ransomware was successfully executed.
## Lessons Learned
- **Vulnerability Speed:** The window between vulnerability disclosure and mass exploitation is shrinking (N-day to 0-day speed).
- **RMM Risks:** Management tools are "force multipliers" for attackers; a single compromise leads to thousands of victims.
- **Legacy Code:** Leaked ransomware builders (LockBit 3.0) continue to be used by unaffiliated actors.
## Recommendations
- **Immediate Patching:** Update ScreenConnect to the latest secure version immediately.
- **Log Review:** Audit ScreenConnect logs for the creation of unexpected internal users.
- **Egress Filtering:** Restrict servers from initiating outbound connections to unknown IP addresses.
- **MFA:** Enforce Multi-Factor Authentication across all administrative interfaces.