ScreenConnect Supply Chain Attacks Deploy Rogue Clients on 288 Endpoints Across 48 Organizations
A wave of attacks leveraging compromised or hijacked ScreenConnect instances has led to the deployment of rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The attacker exploits third-party extensions and compromised credentials or sessions to gain access to ScreenConnect panels, then uses the Run Command feature to install a persistent backdoor toolkit named SCKit. This malware establishes remote access, steals authentication tokens, and propagates laterally between technician workstations and managed endpoints. ConnectWise, the vendor behind ScreenConnect, denies its infrastructure or software was compromised but has disabled five third-party extensions across partner environments as a precaution. Indicators of compromise include specific IPs, domains, and malware artifacts. The attack employs a worm-like two-step method involving initial rogue client deployment and lateral movement to technicians' machines, with some scripts apparently generated via large language models. The full scope and initial access vector remain under investigation.
Linha do tempo
-
ScreenConnect Supply Chain Attacks Deploy Rogue Clients on 288 Endpoints Across 48 Organizations
ler a análise desta fonte ocultar
A wave of attacks leveraging compromised or hijacked ScreenConnect instances has led to the deployment of rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The attacker exploits third-party extensions and compromised credentials or sessions to gain access to ScreenConnect panels, then uses the Run Command feature to install a persistent backdoor toolkit named SCKit. This malware establishes remote access, steals authentication tokens, and propagates laterally between technician workstations and managed endpoints. ConnectWise, the vendor behind ScreenConnect, denies its infrastructure or software was compromised but has disabled five third-party extensions across partner environments as a precaution. Indicators of compromise include specific IPs, domains, and malware artifacts. The attack employs a worm-like two-step method involving initial rogue client deployment and lateral movement to technicians' machines, with some scripts apparently generated via large language models. The full scope and initial access vector remain under investigation.