ConnectWise Sounds the Alarm on Critical RCE Vulnerability in ScreenConnect

ConnectWise has issued an urgent battle cry to all ScreenConnect administrators – a clarion call to patch, fortify, and defend against a menacing, maximum severity flaw threatening to plunge servers into the abyss of remote code execution (RCE) chaos. The same vulnerability has been published under CVE-2024-1709

The relentless juggernaut that is LockBit ransomware has seized the opportunity to wreak havoc on unsuspecting victims. Today, the ominous truth was laid bare by Sophos X-Ops – threat actors, emboldened by the exploitation of the recent ConnectWise ScreenConnect vulnerabilities (CVE-2024-1708 / CVE-2024-1709), have plunged organizations into the abyss of LockBit-infested nightmares.

Sophos’ threat response task force delivered a chilling revelation: “In the last 24 hours, we’ve observed several LockBit attacks, apparently after exploitation of the recent ConnectWise ScreenConnect vulnerabilities.” The battlefield is not dormant; it’s ablaze with the ruthless deployment of ransomware, a stark reminder that the cyber underworld respects no ceasefire.

Two alarming facets pierce through the chaos. First, the ScreenConnect vulnerabilities, once mere vulnerabilities, now stand as gateways actively exploited in the wild. The warning issued by ConnectWise was not a call into the void; it was a prophecy of impending doom. Second, in defiance of law enforcement operations against LockBit, the malevolent affiliates persist, orchestrating digital onslaughts with an audacity that mocks attempts to dismantle their nefarious empire.

Huntress, the cyber watchdogs, echoed the grim reality – a local government, entrusted with the critical systems linked to their 911 infrastructure, has fallen prey to LockBit ransomware. A healthcare clinic, a bastion of well-being, now echoes with the sinister whispers of digital intrusion. The weapon of choice? Exploits stemming from the very vulnerabilities ConnectWise sought to eradicate.

“We can confirm that the malware being deployed is associated with Lockbit,” affirmed Huntress in an email. Yet, the tendrils of this cyber Hydra extend beyond easy attribution to the larger LockBit group. It’s a chilling reminder that LockBit, despite major law enforcement crackdowns, persists as an indomitable force, spanning tooling, affiliate groups, and offshoots that endure the relentless storm.

This is not just an attack on servers and systems; it’s an assault on the sanctuaries of governance and health. The cyber malevolence manifested in LockBit ransomware leaves no room for complacency. The time for action is now, and the defenders must rise with unparalleled ferocity.

ConnectWise’s warning wasn’t merely a cautionary tale; it was a battle cry. The LockBit menace is real, and it’s exploiting the very vulnerabilities that were supposed to be sealed. The defenders are under siege, but capitulation is not an option. LockBit has shown its hand, and the response must be aggressive, unyielding, and swift. The battleground is now, and the war against LockBit is one that cannot be lost.

Picture this: an insidious authentication bypass weakness, a gateway for malevolent forces to infiltrate and maraud through your servers, seizing confidential data with merciless impunity. This is not just a theoretical menace; it’s a ticking time bomb primed for exploitation by attackers, launching low-complexity assaults that mock the need for user interaction.

But that’s not all. ConnectWise has unearthed and quashed another serpent in the form of a path traversal vulnerability lurking within its remote desktop software. A vulnerability reserved for those with high privileges – a menacing elite among attackers.

The revelation dropped on February 13, 2024, a day that should echo in the annals of cybersecurity history. ConnectWise, in a stern tone, asserts that though the wild remains untainted by the exploits of these vulnerabilities, the time for complacency is over. On-premise partners, beware – immediate action is not just recommended; it’s imperative.

ConnectWise has refrained from bestowing CVE IDs upon these twin demons, aptly haunting all servers imprisoned by ScreenConnect 23.9.7 and its predecessors. The gauntlet has been thrown, and on-premise warriors must rise.

The cloud, a sanctuary for some, is already shrouded against potential attacks. But for the guardians of on-premise realms, there’s no time for respite. The decree is clear – ascend to ScreenConnect version 23.9.8, or risk being engulfed by the impending storm.

Huntress, the vigilant hunters of the cybersecurity realm, reveal a gut-wrenching reality. A proof-of-concept exploit has been birthed from the loins of vulnerability, a weapon designed to dismantle the feeble defenses of unpatched ScreenConnect servers. Censys, the exposé maestro, unveils a staggering 8,800 vulnerable servers ripe for exploitation.

Shodan’s watchful eye reveals a dismal scenario – only 160 servers stand fortified with the shield of ScreenConnect 23.9.8.

The entry point to this tumult – remote desktop software, wielded by threat actors with diabolical intent. With the finesse of infiltrators, they metamorphose into local users, sidestepping admin permissions and evading the need for new software installations. The compromised user becomes a pawn, unwittingly granting access to an entire network.

This is not a mere cautionary tale; it’s a war cry against the malevolent forces that have, for years, wielded ScreenConnect as a weapon for data theft and the deployment of ransomware payloads. The threat landscape has evolved, with Huntress unearthing instances of local ScreenConnect becoming a sinister tool for persistent access to compromised networks.

The battlefield is set, and the stakes are higher than ever. ConnectWise has sounded the alarm, and the time for action is now. The defenders must rise, fortify their servers, and repel the looming threat. Failure to act is not an option; it’s an invitation to chaos. The choice is clear – patch or perish.