Attack Chain

As the source material only identifies a vulnerability and not observed exploitation, the following attack chain is based on potential exploitation scenarios:

1. Initial Access: Attacker identifies a ScreenConnect 26.1 server exposed to the internet.
2. Vulnerability Scan: Attacker uses automated tools or manual techniques to probe the server and confirm the presence of the cryptographic material protection vulnerability.
3. Exploitation: Attacker leverages the vulnerability to gain unauthorized access to the server’s file system or memory. This may involve exploiting weak encryption algorithms or insufficient access controls.
4. Cryptographic Material Extraction: Attacker locates and extracts the server-level cryptographic material, such as private keys, certificates, or other sensitive configuration data.
5. Privilege Escalation: The attacker uses the obtained cryptographic material to impersonate legitimate users or processes, potentially gaining elevated privileges within the ScreenConnect system.
6. Lateral Movement: With elevated privileges, the attacker moves laterally within the network, potentially accessing other systems or data that are accessible from the compromised ScreenConnect server.
7. Data Exfiltration or System Compromise: Attacker uses the compromised ScreenConnect server to exfiltrate sensitive data from connected systems or to further compromise other hosts on the network.
8. Persistence: Attacker establishes persistent access by creating new administrative accounts or backdoors, using the compromised cryptographic material to maintain access even after the initial vulnerability is patched.

Impact

Successful exploitation of this vulnerability could allow an attacker to gain complete control over the ScreenConnect server and any systems connected to it. The impact includes unauthorized access to sensitive data, potential data breaches, and disruption of critical business operations. Depending on the scope of the ScreenConnect deployment, this could affect a single organization or multiple organizations using the same instance.

Recommendation

• Upgrade ScreenConnect to the latest version to address the cryptographic material protection vulnerability.
• Review and implement the security hardening recommendations provided by ConnectWise to further secure your ScreenConnect deployment.
• Monitor ScreenConnect servers for suspicious activity, such as unauthorized access attempts or unusual file access patterns (using process_creation, file_event and network_connection log sources).
• Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts related to this vulnerability.

Attack Chain

1. The attacker gains unauthorized access to a system with ScreenConnect installed. This could be achieved through exploiting vulnerabilities like CVE-2024-1709 and CVE-2024-1708, or through credential compromise.
2. The attacker uses ScreenConnect to connect to the compromised system remotely.
3. The attacker uses the ScreenConnect interface to execute commands on the remote system.
4. The attacker spawns a command interpreter, such as cmd.exe, using ScreenConnect. This process is a child process of the ScreenConnect client process.
5. The attacker uses cmd.exe to execute malicious commands, such as downloading and executing a malicious payload.
6. Alternatively, the attacker spawns powershell.exe with encoded commands or commands to download and execute malicious payloads from a remote server.
7. The attacker establishes persistence by creating a scheduled task using schtasks.exe or creates a new service using sc.exe.
8. The attacker uses tools like net.exe to modify user accounts or privileges to maintain access to the compromised system.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, installation of malware, and establishment of persistent access to the compromised system. This can result in data theft, disruption of services, and further lateral movement within the network. The number of victims and specific sectors targeted varies depending on the attacker’s objectives, but the impact can be significant for organizations relying on ScreenConnect for remote support.

Recommendation

• Deploy the Sigma rules provided in this brief to your SIEM to detect suspicious child processes spawned by ScreenConnect and tune for your environment.
• Monitor process creation events for ScreenConnect client processes spawning suspicious child processes like powershell.exe, cmd.exe, net.exe, schtasks.exe, sc.exe, rundll32.exe, mshta.exe, certutil.exe, wscript.exe, cscript.exe, curl.exe, ssh.exe, scp.exe, wevtutil.exe, wget.exe, or wmic.exe as detailed in the Sigma rules.
• Enable Sysmon process-creation logging to capture the necessary process execution data to activate the rules above.
• Review and revoke any unauthorized user accounts or privileges that may have been created or modified using tools like net.exe as described in the attack chain.