Security researchers document active exploitation of the ScreenConnect vulnerability dubbed “SlashAndGrab,” with adversaries leveraging it for post-exploitation tradecraft including ransomware, cryptominers, and remote access. The activity spans LockBit-style ransomware, Cobalt Strike beacons, various persistence and evasion techniques, and broad reconnaissance across victims; defenders are urged to monitor for indicators tied to ScreenConnect abuse and related tools. #SlashAndGrab #ScreenConnect #LockBit #CobaltStrike #ChromeRemoteDesktop #SimpleHelpRMM #Huntress #CVE-2024-1709 #CVE-2024-1708
Keypoints
- The Huntress SOC reports active exploitation of the ScreenConnect vulnerability “SlashAndGrab” used by threat actors for post-exploitation activity.
- Ransomware deployments are common, including a LockBit variant and other campaigns using MSI payloads and startup-folder persistence.
- Ransomware anti-forensics attempts include clearing event logs with wevtutil.exe and other efforts to hinder investigation.
- Threat actors enumerate privileged users across networks to guide post-compromise actions and escalation.
- Adversaries install additional remote access tools (Simple Help RMM, SSH backdoors, Chrome Remote Desktop) for persistence.
- Cryptocurrency mining is widely deployed, including masquerading miners as legitimate software (SentinelOne) and using mining payloads sourced via various download methods.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Adversaries are leveraging a path traversal bug and auth bypass in ScreenConnect that allows them to create a privileged account for remote control. Quote: “Adversaries are leveraging a path traversal bug and auth bypass in ScreenConnect that allows them to create a privileged account for remote control.”
- [T1087] Account Discovery – Adversaries are attempting to discover privileged users by running a script across compromised systems. Quote: “Adversaries are attempting to discover privileged users by running a script across compromised systems.”
- [T1562.001] Disable or Modify Tools – Adversaries are attempting to evade detection by adding exclusion paths to Windows Defender using PowerShell. Quote: “Adversaries are attempting to evade detection by adding exclusion paths to Windows Defender using PowerShell.”
- [T1070.001] Clear Windows Event Logs – Ransomware actors attempt to remove event logs using wevtutil.exe cl. Quote: “Ransomware actors attempt to remove event logs using wevtutil.exe cl.”
- [T1059] Command and Scripting Interpreter – Adversaries are using PowerShell and CMD to download and execute scripts from remote locations. Quote: “Adversaries are using PowerShell and CMD to download and execute scripts from remote locations, facilitating various activities such as cryptocurrency mining and remote access.”
- [T1053] Scheduled Task – Adversaries are creating scheduled tasks for their cryptominers and remote access. Quote: “Adversaries are creating scheduled tasks for their cryptominers and remote access.”
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Adversaries stored their MSI ransomware payload in the Public startup folder. Quote: “Adversaries stored their MSI ransomware payload in the Public startup folder.”
- [T1136] Create Account – Adversaries created new users and in some instances added them to privileged groups. Quote: “Adversaries created new users and in some instances added them to privileged groups.”
- [T1053] Scheduled Task – (Persistence) Adversaries are creating scheduled tasks for their cryptominers and remote access. Quote: “Adversaries are creating scheduled tasks for their cryptominers and remote access.”
- [T1546.003] Event Triggered Execution: Windows Management Instrumentation Event Subscription – Adversaries are modifying the registry to achieve persistence by adding WMI Event Consumers. Quote: “Adversaries are modifying the registry to achieve persistence by adding WMI Event Consumers.”
- [T1133] External Remote Services – Adversaries are compromising ScreenConnect instances, deploying SSH tunnels, Chrome remote desktops, and alternate RMMs for evasive, persistent remote access. Quote: “Adversaries are compromising ScreenConnect instances, deploying SSH tunnels, Chrome remote desktops, and alternate RMMs for evasive, persistent remote access.”
- [T1105] Ingress Tool Transfer – Adversaries are downloading files using curl, certutil, and Invoke-WebRequest. Quote: “Adversaries are downloading files using curl, certutil, and Invoke-WebRequest.”
- [T1572] Protocol Tunneling – Adversaries created SSH tunnels for communication. Quote: “Adversaries created SSH tunnels for communication.”
- [T1496] Resource Hijacking – Cryptocurrency miners are being deployed by adversaries. Quote: “Cryptocurrency miners are being deployed by adversaries.”
- [T1486] Data Encrypted for Impact – Adversaries deployed ransomware via compromised ScreenConnect. Quote: “Adversaries deployed ransomware via compromised ScreenConnect.”
- [T1107] Software S0154: Cobalt Strike – Adversaries are leveraging Cobalt Strike beacons to achieve C2 connections to compromised ScreenConnect machines. Quote: “Adversaries are leveraging Cobalt Strike beacons to achieve C2 connections to compromised ScreenConnect machines.”
- [T1071.001] Web Protocols – Adversaries use Cobalt Strike beacons to reach C2 over web protocols. Quote: “Adversaries are leveraging Cobalt Strike beacons to achieve C2 connections to compromised ScreenConnect machines.”
Indicators of Compromise
- [File] LB3.exe (masquerading ransomware) – C:WindowsTEMPScreenConnect22.5.7881.8171LB3.exe, 78a11835b48bbe6a0127b777c0c3cc102e726205f67afefcd82f073e56489e49
- [URL] http://23.26.137.225:8084/msappdata.msi – 8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600
- [File] UPX.exe – 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a
- [File] svchost.exe – a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0
- [URL] https://dl.google.com/edgedl/chrome-remote-desktop/chromeremotedesktophost.msi – c47bfe3b3eccc86f87d2b6a38f0f39968f6147c2854f51f235454a54e2134265
- [IP] 91.92.240.71 – Simple Help RMM IPv4
- [URL] Transfer.sh payloads (various config/jsons) – example: https://transfer.sh/GElU1LmvbS/injcet.ps1
- [File] driver.dll – 6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090
- [IP] 159.65.130.146:4444 – svchost.exe on remote host
- [File] SentinelUI.exe (masquerade as miner) – http://185.232.92.32:8888/SentinelUI.exe