Malware
Black Basta
Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying.
Read more
Exploited vulnerability
ScreenConnect authentication bypass (CVE-2024-1709)
CVE-2024-1709
CVE-2024-1709 is a flaw in ConnectWise ScreenConnect, a tool IT teams use to control computers remotely.
- On CISA KEV
- CVE ID
- CVE-2024-1709
- CISA KEV
- Listed
- Affected product
- ScreenConnect
- Exploited
- Yes
- Published
- February 2024
In short
CVE-2024-1709 is a flaw in ConnectWise ScreenConnect, a tool IT teams use to control computers remotely. Per CISA, an attacker who can reach the management page can create a new administrator account without logging in. CISA says Black Basta ransomware affiliates exploited it from February 2024.
- CVECVE-2024-1709
- ProductConnectWise ScreenConnect
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedFollow the KEV instruction
What it allows
Authentication bypass means getting in without proving who you are. Per CISA, an attacker with network access to the ScreenConnect management interface can create a new administrator-level account on the affected server. An administrator on a remote support tool can reach the computers it manages, so one flaw can open many networks at once.
Who is affected
NVD lists ConnectWise ScreenConnect 23.9.7 and prior, which means every version before 23.9.8.
NVD published the record on 21 February 2024, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 22 February 2024, the next day. The KEV entry flags known use in ransomware campaigns.
In the joint #StopRansomware advisory on Black Basta (AA24-131A, last revised 8 November 2024), CISA and its partners say Black Basta affiliates began exploiting CVE-2024-1709 in February 2024.
Who exploits it
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
What to do
-
Update to version 23.9.8 or later
NVD marks every version before 23.9.8 as affected. Move to a fixed release and follow the vendor's own bulletin for the exact steps.
-
Follow the KEV instruction
CISA's KEV entry says to apply mitigations per vendor instructions, or stop using the product if mitigations are not available.
-
Check for administrator accounts you did not create
The flaw lets an attacker add an administrator, so review the user list on every ScreenConnect server. This is a sensible check that follows from how the flaw works, not a step quoted from the advisories.
-
Keep the management page off the open internet
CISA describes the attacker as needing network access to the management interface. Limit who can reach it.
-
Treat a hit as a possible ransomware lead
Black Basta affiliates used this flaw per CISA, so if you find an unknown account, start incident response and check the machines the tool controls.
Questions
What is CVE-2024-1709?
It is an authentication bypass in ConnectWise ScreenConnect, a remote support tool. Per CISA, an attacker with network access to the management interface can create a new administrator account without logging in.
Which ScreenConnect versions are affected?
NVD lists ScreenConnect 23.9.7 and prior, which means every version before 23.9.8. Updating to 23.9.8 or later is the fix, following the vendor's own bulletin for the exact steps.
Is CVE-2024-1709 used by ransomware groups?
Yes. CISA's Black Basta advisory (AA24-131A) says Black Basta affiliates began exploiting it in February 2024. The Known Exploited Vulnerabilities entry also flags known use in ransomware campaigns.
How do I check if ScreenConnect was abused?
Review the user list on every ScreenConnect server for administrator accounts you did not create, and keep the management page off the open internet. If you find an unknown account, start incident response and check the machines the tool controls.
Sources
- CVE-2024-1709 record NIST NVD
- Known Exploited Vulnerabilities catalog (JSON feed) CISA
- #StopRansomware: Black Basta (AA24-131A) CISA, FBI, HHS, MS-ISAC
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.