Active ScreenConnect attacks compromise MSPs and deploy rogue remote-access clients
Attackers are using compromised cloud-hosted ScreenConnect environments to deploy rogue remote-access clients to customer devices, Huntress said on November 11. The campaign started around 17:47 UTC that day, and Huntress had identified six compromised managed service providers, more than 286 affected endpoints and 47 organizations when it reported the activity. The number of victims was still rising.
The attackers are abusing ScreenConnect's Run Command function, according to Huntress. That function lets an operator execute commands on managed endpoints. In this campaign, it was used to install ScreenConnect clients that provide remote access outside the legitimate MSP environment.
Huntress also reported a possible reverse-pivot technique. An attacker may be able to compromise an MSP technician's workstation when the technician starts a ScreenConnect session with an infected customer device. The researchers said they do not yet know how that technique works or whether it exploits a vulnerability or abuses legitimate ScreenConnect functionality.
ConnectWise said it is investigating the attacks and urged partners not to open interactive ScreenConnect sessions with suspected compromised devices. The company recommended using separate security tooling for investigation, reviewing account activity, revoking active sessions, resetting credentials from a trusted device and verifying multifactor authentication.
Huntress has not established how the attackers first entered the affected MSP environments. Its current telemetry points to compromised credentials and hijacked MSP support sessions. The researchers also said sequential attacker-assigned identifiers may indicate that other MSPs were compromised earlier, so ScreenConnect operators should inspect Run Command history even when they have received no alert.
Huntress shared indicators of compromise including rogue ScreenConnect client IDs, attacker infrastructure and file names. The reported rogue client IDs are 2588ef5c15954b10 and ed630cc2c873b091. Operators can use those indicators when reviewing ScreenConnect activity and endpoint telemetry.