ScreenConnect Compromise: Hackers Are Watching, Are You Ready? | Threat SnapShot скачать в хорошем качестве

ScreenConnect Compromise: Hackers Are Watching, Are You Ready? | Threat SnapShot

We know threat actors use RMM tools for command and control and to blend in with other legitimate activity in networks. But how about exploiting RMM tools for fun, profit, and remote code execution? In this week's Threat SnapShot, we'll look at two recent vulnerabilities in ConnectWise ScreenConnect (CVE-2024-1708 and CVE-2024-1709) an authentication bypass and directory traversal that can be combined together to achieve remote code execution. There are over 8,000 vulnerable versions exposed on the Internet, proof of concept exploits are available, and we're seeing evidence of exploitation activity now by threat actors. Patching should be done immediately, and ConnectWise is making the patches available even to customers outside their license's maintenance window, but in the meantime we'll discuss detection and hunting strategies to defend your organization. References: https://www.connectwise.com/company/t... https://www.huntress.com/blog/a-catas... https://www.huntress.com/blog/detecti... https://cybir.com/2022/cve/hijacking-... https://github.com/W01fh4cker/ScreenC... SnapAttack Resources: https://app.snapattack.com/collection... - Collection: ScreenConnect Compromise: Hackers Are Watching, Are You Ready? | Threat SnapShot https://app.snapattack.com/threat/555... - Threat: ScreenConnect Authentication Bypass and Remote Code Execution https://app.snapattack.com/detection/... - Detection: ScreenConnect Auth Bypass https://app.snapattack.com/detection/... - Detection: ScreenConnect Extension Installed https://app.snapattack.com/detection/... - Detection: Suspicious ScreenConnect Child Process https://app.snapattack.com/detection/... - Detection: Possible ScreenConnect Webshell https://app.snapattack.com/detection/... - Detection: CSC Net On The Fly Compilation https://app.snapattack.com/detection/... - Detection: Suspicious ASP Temporary File https://app.snapattack.com/detection/... - Detection: CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation https://app.snapattack.com/detection/... - Detection: ScreenConnect User Database Modification https://app.snapattack.com/detection/... - Detection: ScreenConnect User Database Modification - Security https://app.snapattack.com/detection/... - Detection: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation https://app.snapattack.com/detection/... - Detection: CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security