New ScreenConnect RCE flaw exploited in ransomware attacks

Attackers are actively exploiting a critical ScreenConnect authentication-bypass (CVE-2024-1709) — and a related path traversal bug (CVE-2024-1708) — to breach unpatched servers and deploy LockBit ransomware and variants (including payloads produced with a leaked LockBit builder). Security firms (Sophos, Huntress) observed recent attacks impacting government and healthcare targets; CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities Catalog and ConnectWise urged immediate patching while removing license restrictions to help customers update. Although a global law-enforcement operation (Operation Cronos) seized LockBit infrastructure and released a decryptor, affiliates and offshoots continue to operate and exploit exposed ScreenConnect instances.