Ransomware crews revive mass exploitation of ConnectWise ScreenConnect flaw, pivot through MSPs
Marcus Webb ·
Security teams at managed service providers are responding Wednesday to an active campaign exploiting ConnectWise ScreenConnect servers, using the authentication bypass tracked as CVE-2024-1709 to seize administrative control and deploy ransomware across downstream clients. Incidents are concentrated in North America and Europe, with affiliates leveraging the remote management footprint for high impact access, according to incident responders and network telemetry.
The flaw has been on CISA’s Known Exploited Vulnerabilities catalog since February 2024. Continued exploitation underscores the long tail of self hosted RMM systems that missed emergency patches, and the leverage attackers gain once they control a trusted management plane.
Exploit path and tradecraft
Attackers target internet exposed ScreenConnect instances and hit the SetupWizard endpoint, typically /SetupWizard.aspx or related API paths, to reinitialize an already deployed server and create a new administrator. They then propagate code through ScreenConnect’s remote shell and command features, or by loading a malicious extension, to execute PowerShell or cmd payloads as LocalSystem on enrolled Windows hosts.
Observed post exploitation steps include creation of unexpected administrative accounts, modification of HostClientAccess policies, and use of ScreenConnect services to spawn child processes such as powershell.exe with base64 encoded commands. Affiliates have delivered Cobalt Strike and Sliver beacons, used rclone or MEGAcmd for data theft, and moved laterally via RDP and SMB before deploying lockers linked in past cases to Akira and Black Basta.
Investigators flag server logs that show SetupWizard access after initial commissioning, the appearance of new or unknown extensions in the App_Extensions directory, and ScreenConnect service initiated process trees. Mass client impact often follows within hours due to the centralized push model.
Mitigation and detection
ConnectWise patches released in February 2024 address CVE-2024-1709 and the companion path traversal CVE-2024-1708. Organizations should update to the latest ScreenConnect build, revoke any deferred update settings, and restrict administrative interfaces to VPN or allow listed IPs.
Audit for newly created ScreenConnect users and API keys, review extension inventories, and hunt for SetupWizard requests in web logs. Add detections for ScreenConnect service spawning shells, unexpected use of compression tools like 7zip prior to exfiltration, and outbound connections to cloud storage providers. If compromise is suspected, assume downstream agent abuse, rotate credentials at scale, and rebuild the RMM server from a known good image before re enrolling clients.
For the broader enterprise landscape, the campaign reinforces that edge management and IT automation platforms remain high value targets. Hardening RMM, tightening app governance, and scoping blast radius through segmentation are now baseline controls for any environment that relies on remote administration.