ScreenConnect Users Targeted in Sophisticated Cyberattack

Mechanism and Scale of the Attack

The remote access and management platform ScreenConnect has become the target of active cyberattacks. Threat actors are manipulating the platform's legitimate features to infiltrate the networks of Managed Service Providers (MSPs), gaining unauthorized access to end-user devices. Current data indicates that dozens of organisations and hundreds of workstations have been affected.

According to research, hackers are abusing the ScreenConnect "Run Command" feature. By doing so, they install malicious remote access clients on target devices, allowing them to control computers while bypassing the MSP’s legitimate systems. Of particular concern is the fact that attackers are attempting to infect the workstations of technicians themselves the moment they connect to an already compromised device.

ConnectWise, the developer of ScreenConnect, has implemented preventative measures. As part of their investigation, they disabled five independent, third-party extensions across approximately 400 partner environments. The company suspects these extensions were the primary vector for distributing the malicious software. However, ConnectWise emphasises that this is a precautionary measure and does not automatically cleanse systems that have already been compromised.

Recommended Actions for Companies

Given the complexity of the situation, experts are urging MSPs to audit their systems immediately. It is recommended to conduct a detailed review of authentication logs, extension installation history, and administrative activity. Furthermore, checking the "Run Command" history is essential to identify suspicious commands that attackers may have left behind.

It is critical that technicians refrain from initiating interactive sessions with suspected devices. Instead, security specialists advise using independent security tools to detect and isolate the issue. While extensions have already been disabled for users of ConnectWise’s cloud services, companies operating on-premises servers must perform this step manually.

Future Threats

Although the exact origin of the attack remains under investigation, there is suspicion that hackers are utilising stolen credentials. There is also speculation that similar attacks may have occurred previously, as indicated by consistent identifiers used by the attackers. Malicious scripts using ScreenConnect clients, which were identified in July of this year, suggest that this campaign may have been in preparation for months.

For IT companies and MSPs operating in Georgia and internationally, this incident serves as a stark reminder that the security of remote management tools is paramount. It is highly recommended to strengthen multi-factor authentication (MFA) and minimise the use of third-party extensions, as these are frequently exploited as attack vectors by cybercriminals.