Attackers hit unpatched ConnectWise ScreenConnect servers, ransomware crews step up Monday activity
Marcus Webb ·
Threat actors are actively targeting unpatched ConnectWise ScreenConnect servers using CVE-2024-1709, with exploitation attempts ramping into Monday across North America and Europe. The unauthenticated access flaw enables code execution on vulnerable remote management servers, which gives adversaries a fast path to domain takeover inside managed service provider environments.
This matters because compromise of a single ScreenConnect instance can cascade to dozens of client networks. Ransomware as a service crews, including affiliates linked to Black Basta and LockBit, have previously leveraged remote management tools for wide blast radius deployment.
Why it matters for MSPs
CVE-2024-1709 is an authentication bypass that exposes administrative setup functions and enables new user creation and extension upload. ConnectWise released fixed builds in February 2024 and forced cloud upgrades, but self hosted servers that were never updated or were later exposed remain at risk. Public scanning data has shown persistent probing of ScreenConnect endpoints, and intrusion reports have tied successful exploitation to rapid hands on keyboard activity and lateral movement.
Once inside, adversaries commonly push PowerShell beacons, abuse built in ScreenConnect functions to pivot, and deploy secondary remote tools such as AnyDesk or Splashtop to maintain access. Several campaigns have installed Cobalt Strike beacons and used the ScreenConnect service account to stage ransomware.
Immediate actions for defenders
Administrators should verify on premises ScreenConnect is updated to 23.9.8 or later, validate that the setup wizard is completed, and restrict the admin portal behind VPN or SSO with MFA. Rotate all ScreenConnect local admin passwords, API keys, OAuth secrets, and revoke any personal access tokens. Review App_Data and audit logs for unexpected user creation, setup wizard re enablement, and unknown App_Extensions. Hunt for recent creation of scheduled tasks, PowerShell download cradle usage, and new remote tool binaries.
If compromise is suspected, remove the host from service, re image, and re enroll using new secrets. Assess downstream client agents for post exploitation actions and disable mass action capabilities until assurance is regained.
Securing remote management and edge admin tooling remains one of the highest leverage defenses for enterprises and MSPs. Asset inventory, exposure reduction, and hard gating RMM access with identity controls can blunt the recurring use of these platforms by both state aligned operators and criminal affiliates.