Ransomware crews still exploiting unpatched ScreenConnect servers, Monday checks urged
Marcus Webb ·
Security teams started Monday facing continued exploitation of ConnectWise ScreenConnect servers via CVE-2024-1709, a critical authentication bypass that enables remote code execution. Adversaries are using compromised remote support consoles to pivot into client networks and stage ransomware, making exposed instances a high risk target at the start of the workweek.
The vulnerability has reliable public exploitation methods and remains listed in CISA’s Known Exploited Vulnerabilities catalog, which signals ongoing in the wild abuse. Remote management software is attractive because a single foothold can push tooling across many endpoints, which compresses dwell time and accelerates impact.
Analysts tracking recent incidents say intruders typically create new admin users inside ScreenConnect, disable or tamper with MFA, and push PowerShell loaders to connected hosts. From there they drop off the shelf tools for lateral movement and exfiltration, then execute ransomware when staff activity peaks.
ConnectWise released fixed builds in February 2024. Defenders should update ScreenConnect to 23.9.8 or later, then immediately rotate all admin passwords, API keys, and service account credentials. If compromise is suspected, treat the server as untrusted, rebuild from a known good baseline, and reissue certificates.
Hunt for persistence that survives patching. Review ScreenConnect admin panels for unfamiliar users, newly granted roles, and altered organizations or session groups. Inspect server file systems for recently modified extensions or plugins, unexpected web.config changes, and scheduled tasks tied to ScreenConnect service accounts.
Audit downstream clients for post exploitation activity. Prioritize endpoints recently accessed through ScreenConnect for signs of Cobalt Strike or other beacons, Rclone or MEGAcmd for data staging, and the creation of new local admins or domain GPO changes that weaken defenses. Block outbound access to common exfiltration destinations and enforce application allowlists on RMM tooling.
Limit blast radius going forward. Place ScreenConnect behind a VPN or zero trust gateway, restrict admin access by source IP, require SSO with phishing resistant MFA, and monitor for anomalous console actions in real time. Maintain offline backups and test restoration so that ransomware deployment through remote tools does not become a single point of failure.
The persistence of ScreenConnect exploitation underscores a broader issue, remote administration platforms sit on the path to many assets and should be treated as tier zero. Vendors and customers that harden identity, network exposure, and telemetry around these tools will reduce the asymmetry that ransomware groups exploit on Monday mornings.