Monday alert: Active exploitation of ConnectWise ScreenConnect flaws fueling rapid ransomware deployment
Marcus Webb ·
Ransomware crews and initial access brokers are actively exploiting ConnectWise ScreenConnect on premises, using CVE-2024-1709 and CVE-2024-1708 to create admin users and push payloads across managed environments. The activity targets managed service providers and enterprises that host ScreenConnect themselves, with intrusions often staged before the workweek and ransomware execution timed for Monday morning.
This matters because the flaws have reliable public exploits and remain in the CISA Known Exploited Vulnerabilities catalog, and opportunistic scanning continues to find exposed servers. Despite patches released by ConnectWise in February 2024, unsupported or lagging deployments persist in the wild, giving crimeware groups a fast path to domain compromise.
How the intrusions unfold
Exploitation of the authentication bypass and path traversal leads to full administrative control of the ScreenConnect instance. Threat actors commonly create new local admin accounts, enroll additional agents, or hijack existing sessions, then execute PowerShell to disable security tools and deploy beacons such as Cobalt Strike or Sliver.
From there, operators pivot to domain controllers using credential dumping and remote service creation, then stage ransomware including Black Basta, LockBit, and Akira. Incident responders report recurring artifacts that include unexpected ScreenConnect user creations, service restarts outside maintenance windows, new scheduled tasks, and lateral movement through remote management tooling already trusted inside the network.
What defenders should do now
If self hosting ScreenConnect, update immediately to a version that remediates CVE-2024-1709 and CVE-2024-1708 and verify the update completed. Review the Users and Security tabs for unfamiliar or recently created accounts, rotate all administrative credentials and API keys, and invalidate persistent sessions.
Hunt for compromise by examining ScreenConnect server and audit logs for new admin creation and logins from unusual IP addresses, reviewing App_Data and App_Extensions for unauthorized files, and correlating with Windows event logs for service creation, PsExec use, and suspicious PowerShell. Quarantine hosts that show unauthorized ScreenConnect agents or secondary remote tools such as AnyDesk deployed without change control.
Restrict ScreenConnect exposure. Place the service behind a VPN or SSO with enforced multifactor authentication, implement IP allowlists, and enable tamper protection on endpoint security. Monitor for known indicators published by ConnectWise, CISA, and incident response firms, and add CVE-2024-1709 and CVE-2024-1708 to patch SLAs where they are not already closed.
For the broader technology landscape, the continued abuse of remote support software underscores that management planes remain high value targets. Organizations are tightening access with identity aware proxies, hardware backed MFA, and network segmentation for admin tooling, and vendors are shipping hardened defaults, but defenders should assume edge management services will be probed first every Monday and instrument them accordingly.