ScreenConnect servers hacked in LockBit ransomware attacks

Attackers are exploiting a critical authentication bypass (CVE-2024-1709) and related ScreenConnect vulnerabilities to breach unpatched servers and deploy LockBit ransomware; Sophos, Huntress and others have observed active intrusions, CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities catalog, and ConnectWise released patches and removed license restrictions so customers can upgrade. Despite a coordinated law-enforcement takedown of LockBit infrastructure (Operation Cronos) and release of decryptors, affiliates and offshoots — including payloads created with a leaked LockBit builder — continue to operate, placing thousands of internet-exposed ScreenConnect instances at risk.