Skip to content

ConnectWise ScreenConnect exploitation wave

Tags

Summary

In February 2024, attackers began exploiting critical vulnerabilities in on-premises ConnectWise ScreenConnect servers, turning a widely deployed remote-support product into an initial-access path for multiple actor sets. ConnectWise's February 19, 2024 security bulletin, CISA's February 22 KEV alert, and CISA's May 2024 Black Basta advisory show why this belongs under Ops: it was a broad exploitation wave against exposed ScreenConnect instances, not a single named campaign with one stable actor identity.

This page uses the descriptive title ConnectWise ScreenConnect exploitation wave because the durable value is the exposure path and downstream abuse pattern. Public reporting in the sources here ties the same vulnerability set to multiple actors, including Black Basta affiliates later in 2024, so no companion Groups or People page is published in this pass.

Naming and companion-page assessment

  • ConnectWise centers the incident on ScreenConnect security fixes for the February 19, 2024 disclosed vulnerabilities.
  • CISA tracks active exploitation under the official CVE identifier CVE-2024-1709.
  • CISA's May 2024 joint advisory says Black Basta affiliates exploited the same ScreenConnect exposure for initial access, which reinforces that the wave spans multiple actors rather than one public operator name.
  • No companion Groups or People page is published in this pass.

Timeline

  • 2024-02-13: ConnectWise says the vulnerabilities were reported through its disclosure channel on February 13, 2024.
  • 2024-02-14: ConnectWise says the vulnerabilities were validated on February 14, 2024.
  • 2024-02-19: ConnectWise published the 23.9.8 security fix and said cloud instances had been remediated within 48 hours of validation.
  • 2024-02-21 to 2024-02-29: ConnectWise's advisory updates told on-prem partners to immediately upgrade, offered interim patched versions for off-maintenance users, and documented compromise indicators such as a reset User.xml containing a newly created user.
  • 2024-02-22: CISA added CVE-2024-1709 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
  • 2024-05: CISA's Black Basta joint advisory said Black Basta affiliates had exploited CVE-2024-1709 for initial access.

2026 ScreenConnect additions (CVE-2026-84869)

  • 2026-09-03: Huntress reported three late-August incidents in separate organizations where socially engineered tech-support scams led to rogue ScreenConnect client installs that behaved like a worm (4-stage VBS loader, PyTorchFix.ps1 elevated payload, and propagation that mirrored the VBS set into the public user directory for newly connected endpoints). Same-day, ConnectWise published a "Guest File Transfer" advisory with no CVE ID or fixed build yet.
  • 2026-09-08: ConnectWise released ScreenConnect 26.6.5, the security patch for CVE-2026-84869 (CVSS 9.9, CWE-269 / CWE-862 — a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or host confirmation; servers are not impacted). ConnectWise marked it Priority 1 High ("being targeted or at higher risk of being targeted by exploits in the wild"). Cloud: no action, but reinstall host clients + update access agents. On-prem: upgrade to 26.6.5 (out-of-maintenance must renew the license first); interim stopgap = deselect TransferFiles / TransferFilesInSession under Administration → Security → Roles.
  • 2026-09-11: CISA added CVE-2026-84869 to the KEV catalog (catalog 2026.09.11), BOD 26-04, due 2026-09-14, Forensics Triage required — formally confirming active exploitation of the client file-execution path Huntress had been tracking. See the CISA KEV September 10–11, 2026 page.

Org context

Because there is no standalone Orgs section in the current taxonomy, the key organizations are summarized here.

ConnectWise

  • ConnectWise's security bulletin says cloud partners were remediated against both February 19 vulnerabilities and required no further action.
  • The same bulletin says on-prem partners had to immediately upgrade to 23.9.8 or later, or use patched interim versions such as 22.4.20001 if off maintenance.
  • ConnectWise's advisory page documented a practical post-compromise indicator: when compromised, the User.xml file may be replaced with a file containing information about one newly created user.

CISA and downstream defenders

  • CISA's February 22 KEV alert confirms that active exploitation was already happening days after public disclosure.
  • CISA's May 2024 joint advisory shows how exploitation of ScreenConnect moved from vulnerability response into ransomware-affiliate initial access and post-exploitation tradecraft.

Operational chain

  1. Attackers exploited the February 2024 ScreenConnect vulnerabilities, especially CVE-2024-1709, against exposed on-premises ScreenConnect servers, according to ConnectWise and CISA.
  2. Successful exploitation gave the attacker control over a remote-support platform already trusted to reach downstream endpoints, which is why the exposure mattered disproportionately for MSPs and IT operators.
  3. ConnectWise's advisory page indicates compromise could create a fresh privileged user entry in User.xml, reflecting attacker attempts to establish persistent administrative control.
  4. CISA's May 2024 advisory shows that at least some actors then used this initial access for wider intrusion activity associated with Black Basta operations.

Evidence and impact

  • ConnectWise says immediate remediation was required for on-prem deployments, which underscores how exposed self-managed instances carried the main risk.
  • CISA formally classified CVE-2024-1709 as known exploited within three days of the public fix.
  • CISA's Black Basta advisory demonstrates the operational consequence: an RMM/support platform flaw became a real-world initial-access path into later ransomware activity.

Defender takeaways

  • Remote-support and RMM infrastructure should be treated as tier-one perimeter risk. If an exposed ScreenConnect server falls, the attacker inherits a trusted administrative foothold.
  • Patch on-prem ScreenConnect quickly and verify the product state afterward. ConnectWise's own guidance emphasizes both upgrading and checking compromise indicators like unexpected User.xml changes.
  • Cloud-hosted remediation does not protect self-hosted deployments. This wave primarily punished organizations still responsible for their own on-prem ScreenConnect patching.
  • Keep the incident name descriptive. Multiple actors reused the same vulnerability path, so the durable lesson is the ScreenConnect exploitation wave, not one group label.

Sources