Live dump of random #CTI / #ThreatIntel as I go through #KittenBusters
1/ If you see the username uuminder in your network and specifically in your ScreenConnect please send my regards to your new Iranian friend. for real hello the PWD is U123um10nder
#CVE-2024-1709 #APT35 @campuscodi.risky.biz

🚨 New CISA Vulnerability Alert 🚨

CRITICAL: Authentication bypass using an alternate path or channel

CVE-2024-1709

Critical infrastructure alert: Medusa ransomware is hitting healthcare, education, and manufacturing with triple extortion tactics. Over 300 orgs compromised. Patch ScreenConnect (CVE-2024-1709) and Fortinet EMS (CVE-2023-48788). CISA advisory details defenses: Read More

米CISAおよびMS-ISACによると、Medusaランサムウェアグループが重要インフラセクターで300以上の組織を攻撃した。このグループは、ScreenConnectの脆弱性CVE-2024-1709と、Fortinetの脆弱性CVE-2023-48788を悪用する。 therecord.media/medusa-ranso...

ScreenConnect RMM tool exploited for persistent access. Attackers use social engineering, modified installers, and vulnerabilities (e.g., CVE-2024-1709) & malicious domains. Strong security & threat intelligence are crucial for mitigation.#ScreenConnectExploit

SimpleHelp リモート サポート ソフトウェアの重大な脆弱性

2024 年は、人気のリモート サポート/アクセス ソフトウェアに影響を及ぼす注目すべきゼロデイ脆弱性で幕開けとなりました。ConnectWise ScreenConnect に影響を及ぼすCVE-2024-1708とCVE-2024-1709 、BeyondTrust 製品に影響を及ぼすCVE-2024-12356とCVE-2024-12686です。これらの脆弱性は実際に悪用されており、CISA の既知の悪用された脆弱性のリストに掲載されています。

www.horizon3.ai/attack-resea...

Rapid7 MDR reveals the most commonly exploited CVEs from January to November 2024:
CVE-2024-3400
CVE-2024-24919
CVE-2024-1709
CVE-2023-48788
CVE-2023-48365
CVE-2023-36025

Regular patching and MFA remain some of the strongest protections.

australiancybersecuritymagazine.com.au/rapid7-revea...

#NorthKorean hackers exploit ConnectWise ScreenConnect vulnerabilities (CVE-2024-1708 & CVE-2024-1709) to deploy TODDLERSHARK malware, adding to the notorious Kimsuky arsenal alongside BabyShark and ReconShark. #malware
thehackernews.com/2024/03/hack...

"TODDLERSHARK: ScreenConnect Vulnerability Exploited to Deploy BABYSHARK Variant" published by Kroll. #TODDLERSHARK, #CVE-2024-1709, #CVE-2024-1708, #KTA082, #CTI, #OSINT, #LAZARUS https://www.kroll.com/en/insights/publications/cyber/screenconnect-vulnerability-exploited-to-deploy-babyshark

A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)

CVE-2024-1709 and CVE-2024-1708 (auth bypass and path traversal in ScreenConnect) abuse in the wild:

www.huntress.com/blog/slashan...

You can now also track ConnectWise ScreenConnect CVE-2024-1709 exploitation attempts (by unique source IPs attacking) as seen by our sensors on our Dashboard -
dashboard.shadowserver.org/statistics/h...

Alerte sécurité 🔒: Failles critiques CVE-2024-1709 et CVE-2024-1708 dans ConnectWise. Patchez vite! #CyberAlerte
👉 https://www.lemagit.fr/actualites/366570873/Administration-a-distance-ConnectWise-ScreenConnect-a-patcher-durgence

CVE-2024-1709 is also now on the US CISA Cyber
KEV list - cisa.gov/known-exploi...

Vendor advisory connectwise.com/company/trus...

If you receive an alert from us on your instances assume compromise

Data has been shared tagged as "vulnerable-screenconnect" but will be tagged "cve-2024-1709" starting from today's scans, now that a CVE has been assigned: shadowserver.org/what-we-do/n...

World map: dashboard.shadowserver.org/statistics/c...

Tree map: dashboard.shadowserver.org/statistics/c...

We've improved the scanning/detection for vulnerable instances of ConnectWise ScreenConnect (CVE-2024-1709/CVE-2024-1708) - we now see over 8200 vulnerable instances (on 2024-02-21).

CVE-2024-1709 is widely exploited in the wild - 643 IPs seen attacking to date by our sensors.