Attackers continue to weaponize ScreenConnect and TeamCity RCEs for rapid domain takeover
Marcus Webb ·
Criminal operators are still mass exploiting critical 2024 flaws in ConnectWise ScreenConnect and JetBrains TeamCity to create admin users and seize control of Windows domains. The activity targets internet exposed instances across North America and Europe, and persists because a sizable population has not applied vendor fixes. The goal is fast initial access that enables credential theft and ransomware deployment.
Both CVE-2024-1709 in ScreenConnect and CVE-2024-27198 in TeamCity have public exploits and are integrated into automated scanners, so unpatched hosts are compromised quickly after exposure. The vulnerabilities were disclosed and patched in 2024, but the exploitation is active and opportunistic, not a new zero day.
Active exploitation of 2024 RCEs
CVE-2024-1709 is an authentication bypass in ScreenConnect that allows an unauthenticated attacker to enable setup flows, create a privileged account, and execute commands via the server. Intruders commonly push PowerShell payloads, dump LSASS to harvest credentials, deploy commercial remote tools such as AnyDesk or Atera for persistence, and enable RDP to support hands on keyboard activity.
CVE-2024-27198 is an authentication bypass in TeamCity that permits creation of administrator accounts and remote code execution through build agents and server endpoints. Attackers add new admin users and tokens, modify build steps to run arbitrary commands as SYSTEM, and drop beacons such as Cobalt Strike or Sliver. Kinsing and other commodity crews previously targeted TeamCity for cryptomining, and nation state groups have exploited older TeamCity flaws, which underscores the appeal of this access path.
These cases highlight the gap between disclosure and remediation. The bugs are not complex to exploit, and they sit on services that often have broad network reach and stored credentials.
Mitigation path
Patch ScreenConnect and TeamCity to a fixed release per vendor advisories, then assume compromise if the instance was internet facing. Rotate application secrets, service credentials, and any domain accounts used by the server or its agents. Revoke and recreate ScreenConnect and TeamCity API tokens and personal access tokens.
Harden exposure. Move admin consoles behind a VPN or an identity aware proxy, enforce SSO with MFA, and restrict access by IP. Disable guest or anonymous access in TeamCity and remove unused plugins. Block direct outbound from these servers except to required update and agent endpoints.
Hunt for persistence. In ScreenConnect, review server audit logs for unexpected user creation, extension uploads, or role changes, and look for newly installed RMM tools and scheduled tasks. In TeamCity, review audit and server logs for new administrators, tokens, and modified build configurations, and scan build agents for unauthorized scripts. In the domain, watch for suspicious PowerShell and WMI, DCSync attempts, and abnormal use of admin shares.
The broader lesson is that self hosted IT and developer tooling remains Tier Zero adjacent. Treat these systems like identity controllers, remove default internet exposure, and couple rapid patching with continuous auditing to close the long tail that attackers continue to mine.