IT firms and their clients hit: hackers hijack ScreenConnect, seize remote control

Hackers are hijacking ScreenConnect, a tool that many IT companies use to manage their clients’ computers remotely. The software maker ConnectWise warns that attackers are deploying rogue software on victim systems. Several third-party add-ons are suspected as a way in, and the firm urges users to disable them.

ConnectWise is investigating a fresh security incident in which attackers are compromising customer ScreenConnect environments. Attackers are gaining unauthorized access to accounts and then using ScreenConnect functionality to compromise victim systems.

“We have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself,” the company says in an updated advisory.

ConnectWise suspects that an unknown threat actor is abusing third-party extensions installed by its partners. These are typically IT service providers that use ScreenConnect to manage their customers’ systems remotely.

The company has flagged five specific add-ons, identified about 400 partner environments that had at least one of them installed, and disabled the extensions where it could. Customers running ScreenConnect on-premises must disable it themselves immediately.

The potentially affected add-ons are as follows:

• Labtech Plus
• RMM Plus
• RMM+
• RMM Plus Password Link
• RMM+ Password Link

“Their presence alone does not establish compromise. These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup,” the advisory explains.

ConnectWise said it is contacting all partners directly and urges them to verify that these extensions are disabled.

Attackers are dropping rogue ScreenConnect on victim machines

The Sophos X-Ops threat research team says it has discovered malicious ScreenConnect deployments, installed by the attackers during this malicious campaign. This gives attackers remote control of the compromised machines and disguises their presence.

In one case, the attackers used curl.exe to download the installer “ScreenConnect.ClientSetup.msi” from their own server and save it to a temporary folder, C:\Windows\TEMP\sc.msi.

“A ScreenConnect-generated command file then launched msiexec.exe to install the client silently,” Sophos said in an advisory.

The attackers also used ScreenConnect scripts to set up additional files, used PowerShell to bypass security policies, and retrieved second-stage instructions from a separate malicious domain.

At least three likely hijacked ScreenConnect environments with separate IDs have been initiating the attacks, executing commands, and deploying malicious instances

Stay on heightened alert

ConnectWise says it can’t see what attackers do inside partners’ or their customers’ systems once they get in.

“Partners must assess their own environments with their security teams or providers,” the company said.

It recommends that IT companies investigate through separate security tooling and avoid interactive ScreenConnect connections if compromise is suspected.

ConnectWise also advises partners to preserve logs and other evidence, revoke active sessions and relevant credentials, enforce MFA, remove unnecessary administrative access, among other things. Affected devices should be isolated and cleaned up in accordance with incident-response procedures.

Even companies that use ScreenConnect without extensions should watch out for any unusual sign-ins, new administrator accounts, changes to user permissions, unexpected extension installations, remote commands, Toolbox, and other suspicious activity.

The advisory lists indicators of compromise that have already been observed in the ongoing attacks.

Sophos recommends investigating any machine where curl or PowerShell was used to download ScreenConnect installers or scripts into the Windows Temp directory and then run them.