Lockbit’s Comeback and Unpatched ConnectWise ScreenConnect Flaws Exploited by Hackers

Two updates to previous stories.

The LockBit ransomware group has reemerged on the dark web with new infrastructure after a recent law enforcement takedown. The group has moved its data leak portal to a new .onion address and listed 12 new victims. The administrator acknowledged that their websites were confiscated due to a known PHP vulnerability and claimed that the FBI hacked their infrastructure.

Hackers are now mass exploiting the two easy-to-exploit security vulnerabilities in ConnectWise ScreenConnect to deploy ransomware and steal sensitive data. ConnectWise disclosed the flaws, an authentication bypass vulnerability, and a path-traversal vulnerability on February 19, but many servers remain vulnerable. Security researchers have observed various threat actors exploiting the flaws, with some attributing the activity to a China-backed hacking group focused on espionage.

Today’s live show highlighted terminology – if you missed it, it’s on YouTube now and drops on the podcast feed on Saturday –a byproduct of this storyline.  The ConnectWise issue is now causing breaches for customers.