In a recent cybersecurity incident, a threat actor successfully breached hundreds of endpoints belonging to ConnectWise ScreenConnect customers. This widespread attack was reported by cybersecurity firm Huntress, highlighting the scale and speed of the operation.
Rapid Deployment of Malware
The attack was first detected on November 11, when unauthorized access to cloud-hosted ScreenConnect panels allowed hackers to execute commands across managed endpoints. Huntress noted that the campaign affected at least six Managed Service Providers (MSPs) and compromised 288 hosts across 48 organizations, all within a span of 90 minutes.
The attackers utilized these commands to deploy unauthorized ScreenConnect clients and a malware suite known as SCKit. This toolkit provides persistent backdoor access, intercepts session cookies, and has the capability to self-replicate. The malware initially spreads through ScreenConnect panels and waits for a technician to connect to the infected endpoint, subsequently attempting to compromise additional sessions accessible to the technician.
Exploiting RMM+ Vulnerabilities
During these attacks, the hackers exploited a vulnerability in the RMM+ extension, a third-party tool for managing ScreenConnect sessions. A flaw in the extension’s versions 1.0.31 and 1.0.32 allowed attackers to bypass authentication by using an unconfigured blank access key. This oversight enabled unauthorized access and command execution without leaving traditional login traces.
Huntress’s analysis revealed that the RMM+ extension was frequently installed for specific projects and often left in place. The critical authentication flaw was that, if an administrator had not set up an access key, the extension would accept an empty one.
Preventive Measures and Industry Response
In response to this breach, ConnectWise took immediate action by disabling five extensions from the RMM+ suite in around 400 ScreenConnect environments. These included Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. Although their presence does not inherently indicate a compromise, the API offered by these extensions allows remote command execution, secured by a partner-configured passphrase.
Both Huntress and ConnectWise have provided indicators of compromise (IoCs) related to this campaign, advising organizations to disable the extensions in their on-premises ScreenConnect setups. This measure aims to prevent further exploitation of these vulnerabilities.
The latest attack on ScreenConnect underscores the vital need for rigorous cybersecurity practices and prompt vulnerability management. As the industry continues to face sophisticated threats, proactive measures and swift responses remain crucial in safeguarding digital infrastructures.
