Black Basta, Bl00dy ransomware gangs join ScreenConnect attacks

**Executive summary:** The Black Basta and Bl00dy ransomware gangs and other threat actors are actively exploiting a critical ScreenConnect authentication bypass (CVE-2024-1709) to create admin accounts on internet-exposed servers, delete other users, deploy web shells and backdoors, and stage ransomware and malware (Cobalt Strike, XWorm, LockBit-derived payloads); ConnectWise released patches, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and telemetry (Shadowserver, Shodan) shows large-scale exposure.