Huntress Traces BlackCat Ransomware Activity to a Likely Compromised ScreenConnect Instance
Summary
Huntress reconstructs a February 2024 ransomware deployment through a likely compromised ScreenConnect instance, detailing an attempted Defender bypass, recovery-disabling commands and PsExec propagation. Logs showed no similar compromise on other Huntress customer-host
Key points
- Huntress analysts investigated alerts on February 22, 2024, and traced activity to a second, likely compromised ScreenConnect instance that had been installed in 2022.
- The endpoint appeared associated with healthcare based on the customer name, but an MSP partner said it had been removed from the customer environment and given to someone else without their knowledge.
- An attacker downloaded a ransomware executable identified as BlackCat; after Windows Defender quarantined the first download, Defender reporting was disabled and the executable was downloaded and launched again.
- The executable ran commands to delete shadow copies, stop IIS, and change the LanmanServer MaxMpxCt setting.
- The ransomware process launched PsExec commands intended to propagate to other endpoints; event logs indicated successful propagation, but those endpoints could not be directly associated with the Huntress customer.
- Huntress found no similar signs of compromise or file encryption on other endpoints in that customer’s infrastructure.
- The article recommends maintaining an accurate asset inventory and reducing attack surface by restricting access to or removing unnecessary applications and services.
Article Details
- Attack Vectors
- The threat actor accessed the endpoint through a second ScreenConnect instance that Huntress assessed as likely compromised; the article does not establish how that instance was compromised.
- The actor used curl to download the BlackCat ransomware executable, temporarily disabled Windows Defender functionality after the initial download was quarantined, and then launched the executable.
- The ransomware executable ran commands to delete shadow copies and stop IIS, and used PsExec with supplied credentials to propagate the executable to other endpoints.
- Defensive Notes
- Maintain an accurate, up-to-date inventory of systems, applications, and services for patching.
- Reduce the attack surface by restricting access to or removing unnecessary applications and services, particularly those that could provide alternate access or bypass protections such as MFA.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//94[.]131[.]109[.]54:6531/iw0pjCKEzADKTMA5Xkv8ZxS6.exe | Payload-download URL used to retrieve the BlackCat ransomware executable. |
MITRE ATT&CK
T1047 · Windows Management InstrumentationThe reported wmic.exe Shadowcopy Delete command used WMIC to delete shadow copies.T1059.003 · Windows Command ShellThe reported activity includes execution of Windows commands for payload download, registry modification, shadow-copy deletion, and stopping IIS.T1078.002 · Domain AccountsThe article reports use of a username to connect to the ScreenConnect instance and supplied domain Administrator credentials in PsExec commands.T1105 · Ingress Tool TransferThe actor used curl to download the ransomware executable from the reported payload URL.T1112 · Modify RegistryA reg add command modified the LanmanServer Parameters MaxMpxCt registry value.T1489 · Service StopThe ransomware executable ran iisreset.exe /stop to stop IIS.T1490 · Inhibit System RecoveryThe ransomware executable ran vssadmin and wmic commands to delete shadow copies, inhibiting recovery.T1562.001 · Disable or Modify ToolsThe actor changed the Windows Defender SpyNetReporting value from 2 to 0, after which SecurityCenter logs reported Defender as snoozed.T1570 · Lateral Tool TransferPsExec commands used the -c option to copy and propagate the ransomware executable to remote endpoints.
Malware
Vendors
ConnectWiseOn February 19, 2024, ConnectWise published a security advisory for ScreenConnect version 23.9.8, referencing two vulnerabilities and software weaknesses. Two days later, on February 21, Huntress published a blogHuntressversion 23.9.8, referencing two vulnerabilities and software weaknesses. Two days later, on February 21, Huntress published a blog explaining the ScreenConnect authentication bypass.
Products
ScreenConnectOn February 19, 2024, ConnectWise published a security advisory for ScreenConnect version 23.9.8, referencing two vulnerabilities and software weaknesses. Two days later, on February 21, Huntress published a blogWindows DefenderTwenty-three seconds later, the file C:\Windows\System32\iw0pjCKEzADKTMA5Xkv8ZxS6.exe was detected by Windows Defender, and the file was successfully quarantined at 14:10:31 UTC.