Ransomware actors pivot through unpatched ScreenConnect servers after weekend intrusions at MSPs
Marcus Webb ·
Incident responders reported a series of intrusions starting late Friday that targeted on premises ConnectWise ScreenConnect servers at managed service providers, leading to pre ransomware staging across customer environments by early Monday. Attackers are exploiting the ScreenConnect authentication bypass and path traversal flaws tracked as CVE-2024-1708 and CVE-2024-1709 on internet exposed servers that remain unpatched.
This matters because MSP compromises amplify impact across downstream tenants, and operators often schedule encryption for Monday mornings when users return and backups are mounted. Shodan and census data still show thousands of ScreenConnect instances online, and ConnectWise has repeatedly urged immediate updates.
In observed cases, intruders created rogue ScreenConnect administrative accounts, abused unattended access sessions, and pushed payloads using the product’s remote tooling. Post compromise activity included deployment of Cobalt Strike or Sliver, installation of additional remote access tools such as AnyDesk, and data staging with Rclone before ransomware execution.
Analysts note the tradecraft mirrors campaigns previously linked to Black Basta and Akira affiliates that leveraged ScreenConnect and other RMM footholds, though current attribution remains preliminary. Some incidents included group policy changes to disable security tooling and the use of PsExec for rapid lateral movement inside Windows domains.
Defenders should verify ScreenConnect is updated to 23.9.8 or later, isolate any server that was exposed prior to patching, and rotate all credentials including the ScreenConnect master key and API tokens. Review application and IIS logs for access to SetupWizard or App_Config resources from unusual IPs, creation of new ScreenConnect users, and unexpected elevation of permissions.
Hunt for new local admin accounts, newly installed services or scheduled tasks, and outbound connections to file sharing providers or command and control such as MEGA, Dropbox, or Telegram APIs. Reset all unattended access session codes, invalidate access tokens, and compare ScreenConnect binaries against vendor hashes to detect tampering.
CISA added CVE-2024-1708 and CVE-2024-1709 to the Known Exploited Vulnerabilities catalog in 2024, and federal agencies were ordered to remediate, but long tail exposure persists in commercial environments. Organizations that rely on MSPs should require multifactor authentication on all RMM consoles, restrict RMM access by source IP, and segregate customer environments to contain blast radius.
Remote management and monitoring platforms remain high value targets because they provide privileged, scripted reach into many endpoints. The weekend activity underscores a broader need to treat RMM infrastructure as Tier 0, enforce least privilege and egress controls around it, and test rapid isolation playbooks for third party access systems.