Security · High impactFan score 67 · Tier A6 sources
ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
The Brief · written from 6 sources
- ConnectWise is investigating an active malware campaign against managed service providers that abuses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices.
- Researchers report at least 288 endpoints across 48 organizations affected, and ConnectWise says nearly 50 organizations had intrusions.
- ConnectWise disabled five third-party ScreenConnect extensions in partner environments; attackers used a flawed legitimate extension to bypass authentication, per SecurityWeek.
Why it matters
Attackers can reach customer machines through trusted MSP remote-management tooling, and the reported campaign has been linked to ransomware deployment, so MSPs and their customers face a wide blast radius.
Who’s affected
- MSPs using ConnectWise ScreenConnect
- ScreenConnect customers with third-party extensions installed
What to do
- Check ScreenConnect environments for unauthorized rogue remote-access clients
- Review installed third-party ScreenConnect extensions and disable any that are not needed or trusted
- #screenconnect
- #msp
- #malware
- #supply-chain
- #ransomware
- #remote-access
Abuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise. Cybersecurity researchers had spotted intrusions at nearly 50.
Timeline
ConnectWise investigates active malware campaign targeting MSPs via ScreenConnect
BleepingComputer
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise disables five third-party extensions in partner environments
The Hacker News
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
SecurityWeek
Hackers Deploy Malware in Fresh ScreenConnect Campaign
www.theregister.com - Articles
Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
The Hacker News
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
The Record from Recorded Future News
ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
Full coverage · 6 sources
- 2h ago ↗
The Record from Recorded Future News
ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
- 5h ago ↗
- 5h ago ↗
www.theregister.com - Articles
Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs - 7h ago ↗
- 13h ago ↗
The Hacker News
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients - 19h ago ↗