Active exploitation of ScreenConnect and TeamCity flaws fuels midweek ransomware intrusions
Marcus Webb ·
Ransomware affiliates continue to exploit Internet exposed ConnectWise ScreenConnect and JetBrains TeamCity servers, taking advantage of CVE-2024-1709 and CVE-2024-27198 to gain administrator access without credentials. Incident responders report rapid post exploitation sequences that pivot to data exfiltration and extortion across North America and Europe.
The two flaws deliver unauthenticated control on remote management and build infrastructure, which compresses dwell time and reduces detection opportunities. Enterprises that have not upgraded or fully remediated these systems remain at elevated risk midweek as disclosure volume and scanning pressure typically peak on Wednesdays.
Exploitation details and tooling
CVE-2024-1709 affects ScreenConnect instances prior to 24.1.3 and allows unauthenticated attackers to create users and run code in the server context. Active campaigns use the flaw to deploy remote access tools such as AnyDesk or MeshAgent, then drop Cobalt Strike or Sliver beacons and enumerate domain trusts. Operators frequently disable endpoint protections through local policy changes and schedule persistence via Windows services.
CVE-2024-27198 is an authentication bypass in TeamCity that grants administrative access and plugin deployment on vulnerable controllers. Threat actors upload malicious plugins to execute commands, harvest stored credentials and tokens, and push payloads to agents. Build secrets and code signing material are high value targets, which extends impact beyond the initial network.
Multiple crews, including LockBit derived operations, Akira, and 8Base, have been observed using these access paths. Common tradecraft includes RDP enablement, credential scraping with LSASS memory access, lateral movement via SMB and WMI, and staged exfiltration with Rclone or SFTP to bulletproof VPS infrastructure.
Mitigation and detection path
Immediate actions include upgrading ScreenConnect to 24.1.4 or later and TeamCity to fixed releases documented by the vendors, then validating integrity. For ScreenConnect, audit for unknown administrator accounts, unexpected extensions, and newly registered services. For TeamCity, enumerate installed plugins, revoke access tokens, rotate project level credentials, and verify agent binaries.
Hunt for web server process spawning archivers, command interpreters, or remote tools. Review IIS and reverse proxy logs for anomalous POST requests to ScreenConnect administrative endpoints and TeamCity REST and plugin upload paths. Block direct Internet exposure of management and CI systems behind a VPN or Zero Trust gateway. Enforce multifactor authentication, device based restrictions, and just in time admin rights for maintenance windows only.
For the wider technology stack, the pattern is clear. Edge management and CI infrastructure carry production level risk, so they require the same isolation, change control, and continuous monitoring as core applications, or they will continue to be the shortest path from scan to breach.