GUEST RESEARCH:\u00a0 Notable threats targeting organisations seen by Barracuda Managed XDR<\/p>\n
\u00a0Takeaways<\/p>\n
\nA rise in attackers trying to use ScreenConnect for unauthorised remote access
\nA rise in Microsoft 365 login attempts from unfamiliar countries
\nAttackers using bought or stolen credentials for ransomware and data theft
<\/p>\n
Attackers using ScreenConnect for unauthorised remote access<\/p>\n
What\u2019s happening?<\/p>\n
The SOC team recently noticed a rise in the suspicious use of ScreenConnect. This includes attackers attempting to connect endpoints to targets\u2019 ScreenConnect deployments, and attackers deploying ScreenConnect themselves to control hosts remotely.<\/p>\n
ScreenConnect is a trusted and popular remote device management tool used by many organisations and their managed service providers. As a result, the detection of ScreenConnect does not immediately arouse suspicion.<\/p>\n
Earlier in 2025, attackers discovered a serious weakness in older versions of ScreenConnect that could allow them break into systems and run harmful programs without permission. Hackers are using this vulnerability to take control of systems remotely, install ransomware, steal data, and to move through the network to other connected systems.<\/p>\n
The successful breach of an existing deployment can give criminals access to many devices and even organisations.<\/p>\n
ScreenConnect released<\/a> a patch for the vulnerability on April 24, 2025.<\/p>\n Your organisation may be at risk if you are:<\/p>\n
To protect your organisation:<\/p>\n
A rise in Microsoft 365 login attempts from unfamiliar countries<\/p>\n What\u2019s happening?<\/p>\n Barracuda\u2019s SOC team has detected a significant rise in attempts to log into Microsoft 365 accounts from countries where the targets don\u2019t operate \u2013 a clear red flag that attackers are trying to access accounts using stolen usernames and passwords.<\/p>\n If the attackers succeed in breaching the network, they can access emails and files and impersonate the legitimate account holder to launch convincing internal phishing attacks and move deeper into the network.<\/p>\n Your organisation may be at risk if you are:<\/p>\n
To protect your organisation:<\/p>\n
Attackers using bought or stolen credentials for ransomware and data theft<\/p>\n What\u2019s happening?<\/p>\n Cybercriminals are stealing or buying usernames and passwords (credentials) and using them to break into systems. Once inside, they launch ransomware attacks or steal sensitive data.<\/p>\n These attacks often look like normal activity because the hackers use genuine credentials. Barracuda Managed XDR\u2019s SOC tools spot the clues left by attackers such as the unusual use of legitimate administrative tools (PsExec, PowerShell), multiple repeat or simultaneous login attempts or the unexpected creation of remote services.<\/p>\n Your organisation may be at risk if you are:<\/p>\n
To protect your organisation:<\/p>\n
How Barracuda Managed XDR can help your organisation<\/p>\n Barracuda Managed XDR delivers advanced protection against the threats identified in this report by combining cutting-edge technology with expert SOC oversight. With real-time threat intelligence, automated responses, a\u00a024\/7\/365 SOC team and\u00a0<\/p>\n
\nRunning older versions of ScreenConnect that haven\u2019t been updated.
\nUsing unmanaged or unauthorised remote access tools.
\nLack multifactor authentication (MFA) for admin accounts.
\nHave not yet applied the software patch to address the bug.
<\/p>\n
\nImplement a strong, multi-layered security solution such as Barracuda XDR Managed Endpoint Security that can spot and contain suspicious ScreenConnect activity.
\nEnsure your ScreenConnect software is running the latest version (25.2.4 or newer).
\nCheck your logs for suspicious or unusual activity.
\nEnable MFA for all accounts, especially administrator accounts.
\nBlock unknown remote access tools and closely monitor attempts to look up or connect to ScreenConnect web addresses.
<\/p>\n
\nNot implement geo-blocking or location-based login rules.\u00a0
\nAllowing employees to use weak or reused passwords.
\nLack MFA or don\u2019t enforce it consistently across the organisation.
\nNot monitoring logins for unusual locations or times
\nLack of monitoring for unusual login patterns.
<\/p>\n
\nEnforce the use of complex, unique passwords, and consider password managers.
\nEnable MFA everywhere \u2013 this is the single, most effective step you can take.
\nMonitor login alerts.
\nImplement conditional access policies that block logins originating from a restricted country\/region.
\nTrain employees to spot phishing attempts and report them.
\nImplement a strong, multi-layered security solution that can spot and block incidents at different stages of the attack chain.
<\/p>\n
\nAllowing employees to use weak or reused passwords.
\nLack MFA or don\u2019t enforce it consistently across the organisation.
\nNot monitoring unusual logins or the use of admin tools.
\nLack alerts for suspicious remote access or script execution.
<\/p>\n
\nEnforce the use of complex, unique passwords.
\nPassword policies that rotate credentials at regular intervals, for example every three months.
\nEnable MFA everywhere, and especially for admin and remote access accounts.
\nMonitor activity, looking for odd login times, the unexpected use of admin tools, or new remote services.
\nTrain employees to spot phishing attempts and report them.
\nImplement a strong, multi-layered security solution that can spot and block incidents at different stages of the attack chain.
<\/p>\n