Morocco warns of cyberattack affecting 288 computers
By the AFREEQUE newsroom, based on Hespress
Morocco’s General Directorate for Information Systems Security warns of a coordinated attack targeting ScreenConnect cloud environments. Attackers took control of at least six providers and sent malicious commands to 288 computers across 48 organisations, according to a ConnectWise alert relayed by the directorate.
The General Directorate for Information Systems Security (DGSSI), Morocco’s cybersecurity body, published an alert on Thursday about a campaign targeting the cloud control panels of ConnectWise ScreenConnect software and managed service providers. The alert draws on a ConnectWise security advisory reporting that the administration consoles of at least six providers were taken over and malicious commands were sent to at least 288 computers across 48 organisations within 90 minutes.
The attacks notably target ScreenConnect environments using five extensions from the RMM+ family, including Labtech Plus, RMM Plus and RMM+ Password Link. The attackers exploited the legitimate "Run Command" function to deploy a remotely controlled client associated with the malicious SCKit tool, which can maintain remote access, modify Microsoft Defender protections and block certain tools used by IT teams. ConnectWise said the investigation was continuing and had found neither a compromise of its own infrastructure nor a vulnerability in ScreenConnect itself.
The campaign mainly concerns cloud versions 26.6.6.9747 and 26.7.6.9783. Researchers suspect a link with an authentication flaw in RMM+ extensions 1.0.31 and 1.0.32 when the access key has never been configured. The DGSSI recommends that affected companies integrate the indicators of compromise provided into their detection and protection systems and immediately disable the five extensions, including in on-premises installations.
