SlashAndGrab: ScreenConnect Post-Exploitation in the Wild (CVE-2024-1709 & CVE-2024-1708)

Huntress SOC observed active, widespread exploitation of a ScreenConnect authentication-bypass/path-traversal vulnerability ("SlashAndGrab") that allowed attackers to create privileged accounts and perform post-compromise activities including deploying LockBit and other ransomware, dropping Cobalt Strike beacons, installing cryptocurrency miners, and installing alternate remote-access/RMM tools for persistence; the report includes ATT&CK mappings, detailed TTP descriptions, and a comprehensive set of IoCs (file paths, hashes, URLs, and IPs) to support detection and remediation.