Plan ahead Medium Check your exposure
ConnectWise disables five extensions as rogue ScreenConnect clients hit 48 organisations
The Hacker NewsConnectWise, ScreenConnect
What happened. ConnectWise disabled five third-party extensions in partner environments after reports of unauthorised access. Attacks with rogue clients reached at least 288 endpoints across 48 organisations. ConnectWise says there is no evidence of a compromise of its infrastructure or a flaw in ScreenConnect.
Who is affected. Partner environments running ConnectWise ScreenConnect with third-party extensions. Industrial sites using it for remote support are exposed, because vendors and engineers often reach plant systems this way.
What to do. Check your ScreenConnect instances for the five disabled extensions and for unknown clients, and follow the ConnectWise advisory.
When to act. Plan ahead: Operators using ScreenConnect should review partner access and extensions before the next maintenance window.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: ScreenConnect is remote-support software, so it forms a remote-access path into plant networks through the industrial DMZ (L3.5) and enterprise IT (L4).
- Are you exposed?
List every ScreenConnect server and installed client, including those run by service providers, and check them against the ConnectWise advisory.
- If you cannot fix it yet
- Limit which accounts can start ScreenConnect sessions and require multi-factor authentication for them.
- Remove third-party extensions you do not need and keep the server off the plant network.
- Watch for
- ScreenConnect clients or sessions that no one on your team or at your provider set up.
- Remote-support connections to plant hosts outside agreed maintenance windows.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
More on ScreenConnect