Active ScreenConnect attacks breach MSPs and deploy ransomware

Tier A · Patch today – Before you go home

Who’s exposed: MSPs using ScreenConnect and their customers' devices

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild

The Brief

ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs).
Attackers use compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
The reported campaign has impacted dozens of organizations.

Why it matters

MSPs that run ScreenConnect and the customers they manage may have hostile remote-access clients on their devices, so affected environments need checking.

The checklist behind the tier

Checklist · 3 of 10 yes

Yes	Hits tech teams	ScreenConnect is remote-access software that IT teams and MSPs run and manage.
No	Core infrastructure	ScreenConnect is a single vendor's product, not software nearly every team runs.
Yes	Popular tool	ScreenConnect is a widely used remote management tool across MSPs and IT teams.
Yes	Exploited in the wild	BleepingComputer: ConnectWise is investigating an active malware campaign against MSPs using compromised ScreenConnect environments.
No	Public exploit	BleepingComputer excerpt reports no published exploit code or proof-of-concept.
No	Remote, no login	BleepingComputer excerpt does not state the attack vector or whether credentials are needed.
No	Full takeover	BleepingComputer says attackers used compromised environments to deploy rogue clients; code execution or admin rights are not explicitly stated.
No	Secrets exposed	BleepingComputer excerpt does not report stolen credentials, tokens, configs or customer data.
No	Supply chain	BleepingComputer: rogue remote-access clients deployed via compromised ScreenConnect environments; not a tampered official package or update.
No	No fix yet	BleepingComputer excerpt does not state whether a patched version is available.

Timeline

Nov 11
BleepingComputer reports ConnectWise is investigating active ScreenConnect attacks on MSPs
Nov 11 · 10:56 PM
BleepingComputer
Active ScreenConnect attacks breach MSPs, impact dozens of organizations

Source

Active ScreenConnect attacks breach MSPs, impact dozens of organizations ↗ BleepingComputer · 54 min ago

First seen 54 min ago · 1 source · Full story page · How tiers are decided