ConnectWise ScreenConnect assaults ship malware – Cyber Tech

Whereas it did not deploy on the client setting, after we ran it on a sandbox, it dropped a ransom be aware that appears like this:

The malware additionally modified the desktop background to this:

So no less than this pattern self-identifies as a variant based mostly on the Lockbit builder code.

AsyncRAT assaults

SophosLabs, who handle our CryptoGuard and HitmanPro instruments, seen a burst of detections downstream of ScreenConnect. Digging in, we are able to see these assaults, wherein a malicious course of is triggering our HollowProcess detection in opposition to PowerShell, intend to ship AsyncRAT as a payload.

Password stealers

Telemetry signifies attackers are additionally pushing the Vidar/Redline knowledge stealer malware (SHA-256 c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f) through ScreenConnect. The HMPA CookieGuard and TTP classifications (T1555.003) set off on any such assault. The assault seems just like the ScreenConnect.WindowsClient.exe launches the malware from this location:

SimpleHelp distant entry consumer, adopted by ransomware

One menace actor abused ScreenConnect to push one other distant entry consumer to the goal machine. On this instance, the attacker used ScreenConnect.WindowsClient.exe to launch the SimpleHelp installer (named first.exe) from this location:

5 hours later, on the identical machine, we noticed ransom notes seem on the system and information renamed with a distinct file extension. The ransomware had been put in utilizing the msiexec.exe utility. The method tree for this occasion regarded like this:

A couple of minutes later, the attackers use ScreenConnect to run a command that downloads one other malware payload to this machine, utilizing the Home windows certutil utility, then runs it.

Rust infostealer

Attackers use the ScreenConnect consumer utility to run a batch script they’ve downloaded into the folder belonging to a different distant entry software. The batch script downloads a payload, written in Rust, from an AWS storage server. The payload, when it runs, injects itself into Explorer.exe then deletes itself from the filesystem.

Analysts haven’t studied the payload, however a number of different distributors classify it as malware known as Redcap, which is used to steal and exfiltrate info from servers.

Cobalt Strike payloads

On February 22, three unrelated corporations (two in North America, one in Europe) have been hit with a remarkably comparable assault that delivered a Cobalt Strike beacon to a machine within the community with the ScreenConnect consumer put in. The telemetry indicated that in all three circumstances, the Cobalt Strike payload was caught and prevented from operating by a behavioral rule known as AMSI/Cobalt-A.

The ScreenConnect consumer acquired a file with a .cmd extension within the short-term listing the place it shops downloaded information, then executed it. The .cmd tried to launch PowerShell to make use of it to obtain the beacon, however was stopped by the endpoint rule. Subsequent evaluation revealed that the payload was retrieved from the identical C2 server in all three circumstances.

Xworm payload tried supply to dwelling person

As soon as decoded, the malware makes use of a wide range of persistence strategies and might unfold to different machines by copying itself to USB storage media. Additionally it is a full-featured RAT and provides an exclusion for itself to Home windows Defender. Nonetheless, the endpoint safety on the client’s machine prevented it from being contaminated. The pre-execution detections Troj/RAT-FJ and Troj/PSDrop-IU successfully neutralized the menace earlier than it may trigger hurt.

Additional makes an attempt

We’ve seen three extra incidents of attackers trying to maneuver deeper into buyer networks after exploiting a vulnerability in ScreenConnect server. In a single, the attacker tried to do reconnaissance on the ScreenConnect server, utilizing PowerShell to attempt to run getlocaluser (to acquire a listing of native person accounts on the server) and ipconfig (to get the native community interface info).

The actor behind the opposite incidents was far more persistent. In one in all their makes an attempt, they first tried to disable Sophos endpoint safety. Then they tried to put in a Cloudflare Tunnel consumer for use as a backdoor, downloading it from Cloudflare’s GitHub web page.

In addition they ran quite a lot of PowerShell instructions in an try to hold out reconnaissance and set up persistence on the compromised server:

The attacker additionally tried to make edits to the server’s Home windows Registry to allow Distant Desktop Protocol entry, and created a persistent process named “Home windows replace” that tried to obtain a payload from sc.ksfe.staff[.]dev. And so they deployed the Empire post-exploitation framework in an try and additional set up persistence and acquire credentials. The identical Empire payload, loaded from the identical distant server, was utilized in a 3rd tried assault we detected. All of this exercise was blocked by Sophos endpoint safety.

Protected Mode RAT deploys its personal ScreenConnect for persistence

In an assault in opposition to the ScreenConnect server situations, a menace actor is pushing an executable named patch3.exe to susceptible servers. The patch3 executable is a RAT with some attention-grabbing behaviors; It apparently provides entries into the registry so that it’ll begin up even when the pc is booted into Protected Mode. It additionally downloads an .msi installer.

MDR analysts trying extra intently into this pattern decided that the menace actor was putting in a brand new occasion of the ScreenConnect consumer on the contaminated system, then utilizing their (the attackers’) personal ScreenConnect consumer to speak to (and remotely handle) the goal’s ScreenConnect server. The contaminated system later launched numerous PowerShell instructions. Irony isn’t lifeless.

Risk looking info

The simplicity of exploiting these vulnerabilities makes it crucial for organizations to evaluate their publicity and take decisive steps to mitigate dangers. The next factors supply a high-level information to research your setting:

Detection and safety

The next detection guidelines have been beforehand applied to determine abuse of ScreenConnect and are nonetheless viable for figuring out post-exploitation exercise.

We’ve a number of protections inside InterceptX to dam post-exploitation exercise. We’ve additionally launched the next detection for publicly obtainable exploit scripts seen focusing on CVE-2024-1709 (CWE-288) — Authentication Bypass Utilizing Alternate Path or Channel:

Protections for SFOS and EPIPS:

Acknowledgments

Anthony Bradshaw, Paul Jaramillo, Jordon Olness, Benjamin Sollman and Dakota Mercer-Szady from MDR

Anand Ajjan, Fraser Howard, Rajesh Nataraj, Gabor Szappanos, and Ronny Tijink from SophosLabs

Peter Mackenzie, Elida Leite and Lee Kirkpatrick from Incident Response

Indicators of compromise relating to those assaults have been printed to the SophosLabs Github.

Concerning the authors

Sophos X-Ops Principal Researcher Andrew Brandt blends a 20-year journalism background with deep, retrospective evaluation of malware infections, ransomware, and cyberattacks because the editor of SophosLabs Uncut. His work with the Labs group helps Sophos defend its international prospects, and alerts the world about notable felony habits and exercise, whether or not it is regular or novel. Comply with him at @[email protected] on Mastadon for up-to-the-minute information about all issues malicious.

Sophos X-Ops Principal Researcher Andrew Brandt blends a 20-year journalism background with deep, retrospective evaluation of malware infections, ransomware, and cyberattacks because the editor of SophosLabs Uncut. His work with the Labs group helps Sophos defend its international prospects, and alerts the world about notable felony habits and exercise, whether or not it is regular or novel. Comply with him at @[email protected] on Mastadon for up-to-the-minute information about all issues malicious.