Overview
ConnectWise is actively investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients. The campaign was first discovered by Huntress, which identified six compromised MSPs and 286 affected endpoints across 47 organizations. The number of victims continues to rise.
Huntress Discovery
The campaign was first discovered Wednesday by cybersecurity firm Huntress, which says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations. ConnectWise is engaged and working with Huntress to address the issue.
ScreenConnect Environment
ScreenConnect is a remote access and support platform used by MSPs and IT teams to remotely manage and troubleshoot customer devices. The attackers are using ScreenConnect's Run Command functionality to deploy rogue ScreenConnect clients on managed endpoints, providing remote access outside of the legitimate MSP's environment.
Compromised Credentials and Workstations
Huntress also warned of a potentially more dangerous technique in which attackers can compromise an MSP technician's workstation when they initiate a ScreenConnect session with an infected customer device. The researchers have not yet determined how the attackers are gaining access to affected MSP environments, but say their current telemetry points to compromised credentials and hijacked MSP support sessions.
IOCs and Stager
Huntress shared indicators of compromise (IOCs) to help organizations identify malicious activity, including rogue ScreenConnect client IDs and infrastructure used by the attackers. The stager is a PHP script hosted on a domain that appears to be used for initial access.
Recommendations
ConnectWise is urging partners to avoid interactive remote sessions with potentially compromised devices and use separate security tooling to investigate. The company will provide further information and guidance through the ConnectWise Trust Center.
Previous Malware Activity
Earlier malware activity linked to rogue ScreenConnect identifier was found, suggesting the ID was used in malicious activity months before the current attacks were disclosed.
Conclusion
ConnectWise is working closely with Huntress to address the issue and provide guidance to its partners to mitigate the risk of further compromise. Organizations are urged to review their environments for signs of compromise and avoid initiating interactive ScreenConnect sessions with potentially infected endpoints.
Comments