Act today High Check your exposure
Hackers abuse ScreenConnect at service providers to reach customers
BleepingComputerConnectWise ScreenConnect
What happened. BleepingComputer reports that ConnectWise is investigating an active malware campaign against managed service providers (MSPs). Attackers use compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
Who is affected. Managed service providers using ConnectWise ScreenConnect and their customers. Industrial sites that let providers reach plant systems through remote-support tools are exposed.
What to do. Check whether your service providers use ConnectWise ScreenConnect to reach your systems. Ask them about compromise, and review remote-access clients on your devices.
When to act. Act today: Sites using ScreenConnect: check for unknown remote-access clients today.
Editor's reading
ForOT security leaddetection engineerIT security
- Purdue level
- L4
- L3.5
Why: Remote-support software is a remote-access path, which sits in the industrial DMZ (L3.5). Customer office devices it reaches are enterprise IT (L4).
- Are you exposed?
List the service providers and ScreenConnect instances that can reach your network, and search endpoints for remote-access clients you did not approve.
- If you cannot fix it yet
- Limit which providers can connect, and require multi-factor authentication on every remote-support path into the plant.
- Keep remote-support access off the plant network until the provider confirms its environment is clean.
- Allowlist approved remote-access software and block other remote-access clients.
- Watch for
- New or unapproved remote-access clients installed on devices, especially ones that connect out to unfamiliar servers.
- Remote-support sessions from provider accounts at unusual times or to hosts they do not normally manage.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: BleepingComputer (opens bleepingcomputer.com)
More on ConnectWise ScreenConnect