Huntress Details Post-Exploitation Activity Following ScreenConnect Vulnerability Exploitation
Summary
Huntress describes SOC-observed attacks exploiting ScreenConnect vulnerabilities, including ransomware and cryptominer deployments, Cobalt Strike activity, additional remote access tools, and persistence across victim networks.
Key points
- Huntress reports adversaries exploited ScreenConnect flaws CVE-2024-1709 and CVE-2024-1708 to gain access and conduct post-exploitation activity.
- Observed payloads included ransomware, cryptocurrency miners, and Cobalt Strike beacons; Windows Defender neutralized some attempts.
- Attackers used PowerShell, curl, and certutil to download tools, and attempted to evade detection by renaming files or modifying antivirus settings.
- Adversaries installed additional remote access tools, including SimpleHelp, SSH tunnels, and Chrome Remote Desktop, and created privileged accounts for persistence.
- Huntress recovered and analyzed a deleted PowerShell script that downloaded a DLL and established persistence through a WMI event consumer.
- Some ransomware appeared associated with LockBit, but Huntress said it found no evidence that this activity undermined the international takedown effort.
Article Details
- Attack Vectors
- Adversaries exploited the ScreenConnect path traversal and authentication-bypass vulnerabilities to gain access and create privileged accounts.
- After gaining ScreenConnect access, adversaries deployed ransomware and cryptocurrency miners, installed alternate remote-access tools, and downloaded Cobalt Strike beacons and other payloads.
- Observed post-exploitation methods included PowerShell and command-shell execution, LOLBins such as certutil, startup-folder persistence, new user creation, scheduled tasks, and WMI event-consumer persistence.
- Defensive Notes
- Apply the rapid ScreenConnect mitigations recommended by Huntress and ConnectWise.
- Monitor for suspicious account creation and privilege changes, event-log clearing with wevtutil.exe, Defender exclusions, startup-folder payloads, scheduled tasks, WMI event consumers, and new remote-access software.
- Huntress reported that Microsoft Defender neutralized several ransomware and Cobalt Strike attempts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cmctt[.]com | Domain used to serve SimpleHelp files renamed as image files in adversarial activity. |
| DOMAIN | minish[.]wiki[.]gd | Domain hosting a Cobalt Strike beacon download identified in the article's indicators. |
| IPV4 | 185[.]232[.]92[.]32 | Host serving the SentinelUI.exe cryptocurrency-miner payload listed in the article's indicators. |
| IPV4 | 185[.]62[.]58[.]132 | IP address the article associates with an adversary running a script across compromised victim networks. |
| IPV4 | 23[.]26[.]137[.]225 | Host serving an MSI ransomware payload identified in the article's indicators. |
| IPV4 | 91[.]92[.]240[.]71 | IP address configured as the communication destination for an adversarially deployed SimpleHelp agent. |
| SHA256 | 0a492d89ea2c05b1724a58dd05b7c4751e1ffdd2eab3a2f6a7ebe65bf3fdd6fe | Hash of a Cobalt Strike beacon listed among the campaign indicators. |
| SHA256 | 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a | Hash of UPX.exe, listed as a ransomware artifact. |
| SHA256 | 2e0df44dd75dbdbd70f1a777178ad8a1867cf0738525508b6120ba21f4505f47 | Hash of the SimpleHelp service configuration file associated with an agent configured to communicate with 91.92.240[.]71. |
| SHA256 | 37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b | Hash associated with a SimpleHelp RMM payload listed in the article's indicators. |
| SHA256 | 6065fee2d0cb0dc7d0c0788e7e9424088e722dfcf9356d20844d7b2d75b20163 | Hash of RunSchedulerTaskOnce.ps1, a malicious persistence script associated with a Cobalt Strike beacon. |
| SHA256 | 69c7fc246c4867f070e1a7b80c7c41574ee76ab54a8b543a1e0f20ce4a0d5cde | Hash of an SSH script listed as an adversarial artifact. |
| SHA256 | 6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090 | Hash of driver.dll associated with the malicious persistence script. |
| SHA256 | 78a11835b48bbe6a0127b777c0c3cc102e726205f67afefcd82f073e56489e49 | Hash of the LockBit-associated ransomware executable LB3.exe observed in the campaign. |
| SHA256 | 81b4a649a42a157facede979828095ccddcdf6cec47e8a3156530e0c02e9625e | Hash of copy.exe, listed as a Cobalt Strike artifact. |
| SHA256 | 8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600 | Hash of an MSI ransomware payload listed in the article's indicators. |
| SHA256 | a0fd0ceb95e775a48a95c00eab42fa5bb170f552005c38812fd03ab4cc14932e | Hash of a SimpleHelp agent executable observed in an adversarial deployment. |
| SHA256 | a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0 | Hash of svchost.exe, listed as a ransomware artifact. |
| SHA256 | aa9f5ed1eede9aac6d07b0ba13b73185838b159006fa83ed45657d7f333a0efe | Hash of Z.zip, listed as an SSH-related adversarial artifact. |
| SHA256 | e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793 | Hash of a SimpleHelp RMM executable observed in adversarial deployment. |
| SHA256 | ec49f5033374eb8f533e291111e1433e2da127f45857aebbbe614e711b3ca989 | Hash of the PowerShell script associated with cryptocurrency-miner delivery. |
| URL | hxxps[:]//transfer[.]sh/8l4d5qR39o/config9[.]json | Specific transfer.sh resource listed as a cryptocurrency-miner configuration file. |
| URL | hxxps[:]//transfer[.]sh/GElU1LmvbS/injcet.ps1 | Specific transfer.sh resource identified as the downloaded cryptocurrency-miner script. |
| URL | hxxps[:]//transfer[.]sh/MRFibhy8fS/config1[.]json | Specific transfer.sh resource listed as a cryptocurrency-miner configuration file. |
| URL | hxxps[:]//transfer[.]sh/ojw6aKoA4A/config11[.]json | Specific transfer.sh resource listed as a cryptocurrency-miner configuration file. |
| URL | hxxps[:]//transfer[.]sh/s27p8BcTxi/config12[.]json | Specific transfer.sh resource listed as a cryptocurrency-miner configuration file. |
MITRE ATT&CK
T1053 · Scheduled Task/JobThe article reports scheduled tasks being created for cryptocurrency miners and remote access.T1059.001 · PowerShellAdversaries used PowerShell, including Invoke-WebRequest, to download and execute scripts and payloads.T1059.003 · Windows Command ShellThe article reports command-shell use to download and execute scripts from remote locations.T1070.001 · Clear Windows Event LogsRansomware actors used wevtutil.exe cl to clear Windows event logs and hinder investigation.T1087 · Account DiscoveryAn adversary ran a script across compromised systems to identify the user with the highest privileges.T1105 · Ingress Tool TransferAdversaries downloaded payloads using curl, certutil, and PowerShell Invoke-WebRequest.T1133 · External Remote ServicesAfter ScreenConnect access, adversaries installed SSH tunnels, Chrome Remote Desktop, and alternate RMM tools for persistent remote access.T1136 · Create AccountAdversaries created new user accounts and added some to privileged groups.T1190 · Exploit Public-Facing ApplicationThe article describes exploitation of ScreenConnect's path traversal and authentication bypass to gain access and create privileged accounts.T1486 · Data Encrypted for ImpactAdversaries deployed ransomware through compromised ScreenConnect access.T1496 · Resource HijackingAdversaries deployed cryptocurrency miners on compromised systems.T1546.003 · Windows Management Instrumentation Event SubscriptionA PowerShell script established persistence using a WMI Event Consumer named System__Cmr.T1547.001 · Registry Run Keys / Startup FolderAn MSI ransomware payload was made persistent via a startup folder.T1562.001 · Disable or Modify ToolsAdversaries added Windows Defender exclusion paths using PowerShell.T1572 · Protocol TunnelingAn adversary deployed an SSH tunnel to facilitate remote access.
CVE
People
Threat Actors
Malware
Vendors
ConnectWiseThis ScreenConnect vulnerability had rapid mitigations suggested by Huntress and ConnectWise that would have undermined the adversary’s access.HuntressTeam HuntressMicrosoftWe observed other ransomware attempts, like upd.exe and svchost.exe, that Microsoft Defender consistently neutralized.
Products
Chrome Remote DesktopGoogle Chrome Remote Desktop https://dl.google.com/edgedl/chrome-remote-desktop/chromeremotedesktophost.msiC:\ProgramData\1.msi c47bfe3b3eccc86f87d2b6a38f0f39968f6147c2854f51f235454a54e2134265Huntress Managed EDRFortunately, Huntress Managed EDR is far too perceptive to entertain adversarial frustration.Microsoft Defender Antimalware PlatformWe observed other ransomware attempts, like upd.exe and svchost.exe, that Microsoft Defender consistently neutralized.ScreenConnectHomeBlogSlashAndGrab: ScreenConnect Post-Exploitation in the Wild (CVE-2024-1709 & CVE-2024-1708)SimpleHelp RMMAn adversary we observed installed the Simple Help RMM, from their ScreenConnect initial access.