Morocco warns of coordinated cyber attacks targeting ScreenConnect systems
The General Directorate for Information Systems Security issued an alert regarding a breach campaign affecting managed cloud service providers. The attack impacted 288 devices across 48 institutions in just 90 minutes.
Morocco alerts to cyber breach campaign targeting ScreenConnect cloud control units
The General Directorate for Information Systems Security (DGSSI) issued a security alert on Thursday warning of a broad cyber attack campaign targeting ConnectWise ScreenConnect cloud-based management units and managed service providers (MSPs). According to Hespress, this alert comes following a security notification issued by ConnectWise regarding a coordinated attack that targeted a number of managed service providers.
Initial data revealed that attackers managed to gain control of administrative control units at no fewer than six service providers, and issued malicious commands on at least 288 devices distributed across 48 institutions, all within just 90 minutes.
Malicious extensions from the RMM+ family
Technical analysis findings linked the incident to ConnectWise ScreenConnect environments using external extensions belonging to the RMM+ family. The five identified extensions include: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link.
ConnectWise, as a precaution, proceeded to disable these extensions in environments where it had access to them, whilst asserting at the same time that the mere presence of these extensions does not conclusively prove the system had been compromised.
"SCKit" tool and its malicious functions
Attackers exploited the legitimate "Run Command" function in ScreenConnect to deploy a second client under their control, alongside a malicious tool known as "SCKit". This tool enables the installation of a malicious client ensuring the continuity of remote access, replacing the legitimate client, and adding exceptions in Microsoft Defender. It also uses AppLocker to prevent information security teams from running processing tools and remedial commands.
"SCKit" establishes its persistence through a scheduled task named "TrapWatch", and seeks to steal the administrative sessions of technicians, which could enable attackers to move laterally and spread towards ScreenConnect management units belonging to other service providers.
The reported attacks primarily affected cloud environments running ScreenConnect versions 26.6.6.9747 and 26.7.6.9783. Researchers believe there is likely a connection to a vulnerability in the authentication mechanism within the RMM+ extension, specifically in versions 1.0.31 and 1.0.32, as the vulnerability appears when administrators have not configured an access key at all, causing the system to accept an empty key.
ConnectWise: investigation ongoing
ConnectWise stated that its investigation is continuing to determine the initial point of entry and the full scope of the incident. The company affirmed that it has found no evidence proving its infrastructure was compromised, or that the ScreenConnect software itself contained a security vulnerability, pointing out that merely updating the software may not be sufficient to remove any potential breach traces.
Immediate protective measures
DGSSI urged affected institutions and their providers to implement urgent preventive measures, among them: integrating the attached indicators of compromise (IOCs) into detection and protection systems, immediately disabling the five extensions in all environments, and keeping them disabled until ConnectWise issues further guidance.
The recommendations also included terminating active sessions on management units, and changing passwords and revoking authentication tokens associated with user accounts and identity providers. The Directorate also called for restricting access to the "Run Command" and "Shared Toolbox" functions to a limited number of administrators, and reviewing audit logs for unusual connections or unauthorised installation operations.
The agency recommended centralising logs across security information and event management systems (SIEM) to detect commands executed on an unusually large number of devices, and alerted to the necessity of verifying the application of updates related to two vulnerabilities previously addressed in earlier security alerts issued by DGSSI.
Source: Hespress