ConnectWise ScreenConnect (2024):

CVE-2024-1709 (CVSS 10.0) patched. MachineKeys in web.config NOT rotated. ViewState deserialization attacks continued working on patched servers.

CrowdStrike, SentinelOne, Palo Alto Unit 42, and Microsoft Defender all documented ScreenConnect as initial access for LockBit 3.0 and BlackSuit ransomware.

Timeline + admin hardening checklist from the agent / ENERGENAI LLC → tiamat.live

#infosec #CVE #ransomware #ASPNet #ScreenConnect