Monday briefing: Ransomware crews still exploiting Cisco ASA VPN and ScreenConnect flaws for initial access
Marcus Webb ·
Ransomware affiliates linked to Akira continue to exploit unpatched Cisco ASA and Firepower Threat Defense VPN web services and vulnerable ConnectWise ScreenConnect servers as teams return to work Monday. The campaigns target internet facing remote access and IT management systems for pre authentication compromise, then use valid credentials and native tools for lateral movement and encryption. Federal and industry advisories list the relevant flaws as actively exploited, which raises the risk for organizations that deferred fixes.
The Cisco ASA and FTD activity centers on CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358, which Cisco addressed in 2024 and which CISA added to the Known Exploited Vulnerabilities catalog. ConnectWise ScreenConnect remote code execution tracked as CVE-2024-1709 remains a favored entry point due to lingering unpatched instances and weak post compromise hygiene.
Active exploitation on edge and RMM
In the Cisco ASA and FTD cases, attackers harvest or bypass authentication on the webvpn portal, establish footholds, and then pivot using valid accounts. Incident responders have documented creation of new local users, changes to remote access profiles, and the use of living off the land techniques including PsExec, WMI, and scheduled tasks, followed by data theft with Rclone or 7 Zip and file encryption.
ScreenConnect compromises commonly involve abuse of the SetupWizard.aspx endpoint to reinitialize and create a new administrator, silent deployment of the remote agent to additional assets, and subsequent domain discovery and credential theft. Logs frequently show unexpected installer or setup activity on servers that were already deployed, as well as new App Extensions directories and unauthorized ScreenConnect users.
Immediate actions for defenders
Prioritize upgrading Cisco ASA and FTD to vendor fixed trains noted in Cisco advisories for CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358, then disable any unused clientless SSL VPN features. Rotate credentials for any accounts configured for VPN authentication, reset SAML or LDAP secrets, and audit for new or modified local users and remote access policies. Review webvpn logs for anomalous source IPs, impossible travel, and unexpected administrative logins.
For ScreenConnect, patch to the latest supported release that remediates CVE-2024-1709, audit for accesses to SetupWizard.aspx after initial deployment, and remove any unauthorized administrators or extensions. Reissue credentials on systems with ScreenConnect agents, and search endpoints for Rclone, 7 Zip, AnyDesk, and Cobalt Strike beacons. Monitor for SMB lateral movement, new services, and use of remote execution utilities outside maintenance windows.
The continued focus on edge appliances and remote management tools shows attackers will keep favoring control planes that sit outside endpoint telemetry. Organizations that retire legacy VPNs, enforce device posture with modern access brokers, and tightly govern remote admin tooling will reduce the blast radius of these recurring intrusion paths.