Monday briefing: Ransomware crews still exploiting unpatched ScreenConnect servers for rapid domain access
Marcus Webb ·
Enterprises running self hosted ConnectWise ScreenConnect remain high value targets, with multiple ransomware affiliates abusing CVE-2024-1709 to seize administrative control of Windows domains. Incident responders continue to see weekend break ins followed by Monday encryption and extortion, often at organizations with internet facing ScreenConnect servers left unpatched or broadly exposed. Impact spans managed service providers and mid market enterprises in North America and Europe.
This is not a new vulnerability, but exploitation remains active and dwell time is short. An RMM foothold grants hands on control with legitimate tooling, which helps adversaries evade EDR and disable backups within hours.
How the intrusions work
Affiliates chain the authentication bypass and path traversal in CVE-2024-1709 and CVE-2024-1708 to create high privilege accounts and push payloads to endpoints. Post exploitation playbooks commonly add secondary RMMs such as AnyDesk, move laterally with PsExec or WMI, and exfiltrate data with Rclone before encryption. Groups including Akira and Black Basta have leveraged ScreenConnect or similar RMM access in recent cases, according to public incident write ups and advisories, and CVE-2024-1709 remains on CISA’s Known Exploited Vulnerabilities list.
Attackers often target backup infrastructure first, attempting to delete shadow copies, purge retention, or disable VSS. They use built in Windows utilities and signed binaries, which reduces detection by signature based controls.
What defenders should do
If self hosted, upgrade ScreenConnect to 23.9.8 or later immediately, rotate all ScreenConnect user passwords and API keys, invalidate all sessions, and review server logs for unexpected admin creation or plugin uploads. Remove public exposure where possible, put the server behind VPN or a zero trust gateway, enforce SSO with MFA, and restrict access by source IP. Inventory and remove orphaned ScreenConnect clients across endpoints.
Hunt for persistence and lateral movement. On Windows, review Event IDs 4624, 4672, 4720, and 7045 from the ScreenConnect host, look for new local admins, new services, or scheduled tasks, and examine process trees where ScreenConnectService spawns PowerShell, cmd, or 7zip. Monitor for outbound Rclone patterns and data egress to cloud storage, and block unauthorized admin tools such as PsExec from non IT subnets.
If compromise is suspected, assume credential theft. Reset domain and privileged accounts, including service principals, isolate RMM servers, validate that backups are immutable and offline, and test restore before reintroducing remote management.
The persistence of RMM centered intrusions underscores that exposure management and identity hardening now drive ransomware risk more than headline vulnerabilities. Organizations that strictly control remote admin paths, enforce MFA everywhere, and segregate backup and management planes will face fewer Monday incidents even as attackers reuse well understood access routes.