Hackers Deploy Malware in Fresh ScreenConnect Campaign
A threat actor has compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a fresh campaign, cybersecurity outfit Huntress reports.
The attacks were observed on November 11, when the hackers abused their unauthorized access to cloud-hosted ScreenConnect panels to run commands on managed endpoints.
According to Huntress, the campaign compromised at least 6 MSPs and 288 hosts across 48 organizations. The attackers hit all 288 compromised hosts within 90 minutes.
The attackers’ commands deployed rogue ScreenConnect clients and a malware toolkit called SCKit that provides persistent backdoor access, intercepts session cookies, and can self-replicate.
Initially deployed via ScreenConnect panels, it waits for a technician to connect to the compromised endpoint to infect their workstation. Next, attempts to compromise other sessions the technician has access to and spread itself to other panels.
“However, not all functionality has been observed during observed incidents; some functionality has been discovered through analyzing...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
