Hackers are exploiting ConnectWise flaws to deploy LockBit ransomware, security experts warn

Security researchers report active exploitation of two high-risk ConnectWise ScreenConnect vulnerabilities (CVE-2024-1709 and CVE-2024-1708) that allow attackers to remotely plant code and deploy LockBit ransomware; Huntress, Sophos, and Shadowserver observed multiple attacks and hundreds of exploit attempts while thousands of servers remain vulnerable, indicating a widespread and ongoing ransomware campaign despite recent law-enforcement disruptions of LockBit infrastructure.