Ransomware crews lean on lingering ScreenConnect flaw after weekend intrusions, Monday detections rise
Marcus Webb ·
Ransomware affiliates are again using unpatched or improperly remediated ConnectWise ScreenConnect servers to enter corporate networks after weekend activity, according to incident responders tracking CVE-2024-1709. Early Monday detections are concentrated among small and midsize enterprises and managed service providers in North America and Europe, where exposed ScreenConnect instances remain accessible from the internet.
The campaigns matter because the ScreenConnect bug enables authentication bypass and code execution, which gives attackers direct remote control with minimal user interaction. Security firms have documented that once inside, affiliates stage tooling on Saturday or Sunday and push encryption jobs during Monday business hours to maximize impact.
How intrusions are happening
CVE-2024-1709 affects ScreenConnect versions prior to 23.9.8 and was added to CISA’s Known Exploited Vulnerabilities catalog in February 2024. Adversaries create or escalate ScreenConnect administrator accounts, pivot to domain controllers, and then deploy ransomware after data theft. LockBit and Akira operators used this access path in 2024, and the same tradecraft remains visible in current cases.
Defenders report common artifacts that include unexplained ScreenConnect admin user creation, suspicious service restarts, and new scheduled tasks or remote tools such as AnyDesk or Rclone dropped from the ScreenConnect host. Review ScreenConnect and Windows event logs for unexpected SetupWizard or user management events, anomalous logon times, and process launches from the ScreenConnect service account, followed by credential dumping or network discovery.
What defenders should do today
If a ScreenConnect server was ever exposed during the 2024 exploitation window and was not rebuilt, assume compromise. Take the server offline, redeploy from a clean image on a supported version, and rotate all credentials including ScreenConnect users, local and domain admins, API keys, and RMM agent tokens. Invalidate all active ScreenConnect sessions, audit for persistence such as new local accounts and scheduled tasks, and hunt for lateral movement and data staging.
Restrict ScreenConnect exposure going forward. Place the service behind a VPN or conditional access, enforce SSO with MFA for administrators, and apply IP allowlisting. Monitor for process creation and network connections originating from the ScreenConnect service, and alert on new admin users or configuration changes outside of change control.
This pattern underscores the systemic risk of remote management software in the hands of adversaries and the compounding impact when MSP infrastructure is abused. Enterprises should apply zero trust controls around administrative tooling and maintain weekend on call coverage for internet facing management applications that sit at the top of attacker prioritization lists.