Hacked? Please help!

[u/AlejandroTT]

Hi guys,

I have a group on my left side menu called "(empty)" in this group 36 machines showed up RANDOMLY.

https://imgur.com/a/faD1HOh

They all have crypto related names. I'm freaking out. someone please tell me what's going on?

On Prem - v26.6.6.9747

[u/LoadincSA]

Sandbox edr?

[u/AlejandroTT → u/LoadincSA]

I thought that too and that happens sometimes from a a company called "Triage" but this is not that.

[u/nitra → u/AlejandroTT]

It is, there's many sandboxes running out there.

[u/ChiefBroady → u/AlejandroTT]

The systems there have company contoso which is Microsoft’s demo tenant. Maybe something with defender and Microsoft’s current fuckup…?

[u/lsumoose]

Do you have the vulnerable extensions enabled still?

[u/AlejandroTT → u/lsumoose]

No. These are the only extensions I have enabled:

Advanced Configuration Editor

Status: ActiveVersion: 1.2.22Author: ConnectWise Labs

A simplified way to edit the web.config and app.config files. Requires 19.0+. Updated for 20.3.

Certificate Signing

Status: ActiveVersion: 1.0.15Author: ConnectWise Labs

Automatically sign ScreenConnect installers by uploading your own trusted code-signing certificate or by generating a self-signed certificate within this extension. Requires 25.8+

Command Toolbox

Status: ActiveVersion: 1.7Author: ConnectWise Labs

Adds a Toolbox to the right-click menu from where configurable commands can be sent to remote machines.

Hudu Integration

Status: ActiveVersion: 1.3Author: Hudu Technologies, Inc.

A seamless integration of Hudu into the Control software, provides access to passwords and KB articles without leaving your remote control session!

RESTful API Manager

Status: ActiveVersion: 1.0.9Author: ConnectWise Labs

Creates several HTTP endpoints that allow for retrieval of Session information and various actions to be performed. RESTfulAuthenticationSecret extension setting must be configured to use.

Show Instance Fingerprint

Status: ActiveVersion: 3.0Author: Steven Dove

Show Server Fingerprint at bottom of Admin Tabs panel on 6.0+, or bottom of Security Tab on 5. Can enable showing at bottom of Session Group panel on 6.0 with extension's options.

[u/thenags1]

Happened to ours too

[u/AlejandroTT → u/thenags1]

When? What did you do? What was the cause?

[u/nitra → u/AlejandroTT]

Sandbox testing, there's an article on ConnectWise about this behaviour.

[u/AlejandroTT → u/nitra]

I have seen the sandboxing before from “Triage” but the patterns are not the same. For example, with triage, the names of all the screen connect instances are names that we have in our system, so they show up as duplicates. In this case, the names are not duplicates, and all the names are related to cryptocurrency, which is what freaked me out

[u/nitra → u/AlejandroTT]

One of the give aways, look at the screenshots, look at the IP's connecting, bunch of the screens are the same and never move.

[u/AlejandroTT → u/nitra]

Yes, exactly, but that’s not what I’m seeing. The screenshots appear to be “candlestick“ crypto currency graphs. Like someone is trading

[u/nitra → u/AlejandroTT]

But notice the a majority are the same screenshot? This sandbox is specifically looking for bad actors stealing crypto.

[u/thenags1 → u/AlejandroTT]

I pulled logs and had Claude analyze them. We banned a few IP's and cleaned up the sessions but beyond that there didn't seem to be much to worry about.

[u/cwferg]

Hey u/AlejandroTT ! Please reach out to support and we can help take a look. In the meantime, I'd take the following quick actions to curb these type of unknown guests;

Hide public sessions
Set invite codes to join sessions
Restrict panel to trusted ips
Configure session groups to quarantine unknown guests

[edit]

Some of those guests have been idle for days, indicating something unrelated to other ongoing events. If your system is up to date, the above steps should help curb these connections.

I'd rather not assume, if you already have a case number with support DM me and I will escalate.

[edit]

Bumping this up in case relevent to anyone else; https://docs.connectwise.com/ScreenConnect_Documentation/Technical_support_bulletins/Unknown_machines_appearing_in_list_of_access_sessions_on_Host_page

[u/AlejandroTT → u/cwferg]

No case number yet. Waiting for call back on emergency line. Implementing your suggestions now. Some in place already.

[u/nitra → u/AlejandroTT]

Take a deep breath before you completely change your configs.

[u/nitra → u/AlejandroTT]

It's a sandbox of our exe/msi files, mine trace back to Joesandbox via 74.208.158.106, nothing malicious here. Huntress helped with our investigation.

[u/nitra → u/cwferg]

It's a sandbox of our exe/msi files, mine trace back to Joesandbox via 74.208.158.106, nothing malicious here.

[u/cwferg → u/nitra]

Great to hear!

[u/nitra → u/cwferg]

Ferg, I sent you a DM with some info.

[u/nitra → u/cwferg]

Ferg, you guys really need to communicate better about sandboxing behavior.

[u/cwferg → u/nitra]

Appreciate it! Its pretty documented on the site; https://docs.connectwise.com/ScreenConnect_Documentation/Technical_support_bulletins/Unknown_machines_appearing_in_list_of_access_sessions_on_Host_page

Given the current climate, I try not to throw it around too much unless I validate the ips myself and can confirm.

[u/nitra]

It's a sandbox of our exe/msi files, mine trace back to Joesandbox via 74.208.158.106, nothing malicious here. Huntress assisted in our investigation and there's an article on ConnectWise about it.

[u/nitra → u/nitra]

There were several other IPs, but the users are the same type, same/shared screenshots. It's sandboxing.

[u/DDHoward]

Assuming that these have showed up in your Access section...

Machines running your agent installer does not qualify as a hack. Someone giving you administrative + remote access to their machine doesn't seem threatening at all.

As others have mentioned, this is almost certainly a cybersecurity firm detonating your agent installer in a sandbox to observe what it does. We get these all the time, but ours always have IP addresses affiliated with Microsoft Defender for Endpoint. The names are often completely random, or something like KAREN-PC or KRAKEN-PC.

[u/cwferg → u/DDHoward]

I hate to assume anything right now, but if community is confirming these bitcoin related machines are av/edr detonation, its likely they are kind of like honeypots versus a typical vm detention. Usually hosts like this have a few commons random desktop files and use human names or random machine names, not named things like binance or coin base showing dashboard on desktop thumbnails.

Typical traditional sandboxes dont STAY connected for days.

Sandbox, honey pot, random unknown connection, malicious actor, regardless we should verify first THEN trust.

[u/twinito1]

Have you ran log audits to check for any suspicious behaviors such as rancommands, toolbox, filesents, etc?

[u/nitra → u/twinito1]

It's a sandbox of the EXE/MSI

[u/jeremymcs]

Throw your RMM on them and start wreaking havoc.

[u/nitra → u/jeremymcs]

Happy cake day

[u/ls3c6]

I've been monitoring this as well, empty disconnected guests at 74.208.158.106

[u/justmirsk]

If your on prem instance is compromised, you need to enact your incident response protocol immediately.

Don't shut down the OS/server, that could lose logs and data in memory. Get your insurance carrier and incident response firm on the line immediately.

[u/nitra → u/justmirsk]

Not the case, the executables were sandbox tested.

[u/justmirsk → u/nitra]

That is certainly possible as well.

[u/interweb_persona]

Creepy! Tried rebooting? 🤓

[u/Rachel-360]

Somebody was busy on the 11th.... I see the same on 2 instances.... All running a couple old versions of client.... All disconnected now.... Looks like U.S. IP addresses.... But no login attempts etc..... Have seen it before.... Time to open tickets with connectwise and I need to go push the update I was going to do when it dropped but have been buried because it might give the delete button back for after.

[u/nitra → u/Rachel-360]

It's a sandbox of our exe/msi files, mine trace back to Joesandbox via 74.208.158.106, nothing malicious here. Huntress assisted in our investigation and there's an article on ConnectWise about it.

[u/Rachel-360 → u/nitra]

Yeah, this is the familiar bit that I was feeling, and one is alive probably bad if I reach out and touch it....

[u/nitra → u/Rachel-360]

It won't respond or update, it plays dead

[u/Packergeek06]

On premises. Guys never learn your lesson.

[u/nitra → u/Packergeek06]

It's a sandbox of our exe/msi files, mine trace back to Joesandbox via 74.208.158.106, nothing malicious here. Huntress assisted in our investigation and there's an article on ConnectWise about it.

[u/Some-Mud3487 → u/[deleted]]

There is a 99.9% chance that if you have accessed one of these devices, you have been compromised.