Sophos Investigates Malicious ScreenConnect Client Deployments
Summary
Sophos observed unauthorized ScreenConnect client deployments and a command chain that downloaded and silently installed a client, then retrieved a second-stage script. ConnectWise is investigating potentially linked extensions and advises disabling identified ones.
Key points
- Sophos observed curl.exe downloading a ScreenConnect installer from 185[.]99[.]255[.]28 to Windows Temp, followed by a silent msiexec.exe installation.
- ScreenConnect scripts staged batch files and used PowerShell with execution-policy bypass to retrieve a second-stage script from ns[.]mo7sen[.]dev.
- The activity originated from three instance IDs that Sophos considers likely compromised; two other IDs were identified as malicious instances.
- ConnectWise confirmed the incident, is investigating multiple third-party extensions that may be linked to the activity, and recommends disabling identified extensions as a precaution.
- Organizations are advised to review ScreenConnect command history for unexpected client deployments or remote commands, and investigate the described download-and-install activity.
- SophosLabs is assessing existing countermeasures and possible additional detections, while reviewing activity across customer environments.
Article Details
- Event Type
- Active campaign involving unauthorized ScreenConnect client deployments
- Impact
- The activity involved downloading and silently installing ScreenConnect clients, executing remote commands, and retrieving a second-stage script. Sophos assessed that three ScreenConnect instances were likely compromised. ConnectWise confirmed the incident and is investigating third-party extensions possibly linked to the activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]99[.]255[.]28 | Source from which curl.exe downloaded the ScreenConnect client installer in an observed malicious deployment. |
MITRE ATT&CK
T1059.001 · PowerShellPowerShell was used with execution-policy bypass to retrieve a second-stage script.T1105 · Ingress Tool TransferThe activity downloaded a ScreenConnect installer and retrieved a second-stage script.T1219 · Remote Access ToolsScreenConnect clients were deployed and used for remote commands in the malicious activity.