Security · High impactFan score 67 · Tier A6 sources

Hackers Deploy Malware in Fresh ScreenConnect Campaign

SecurityWeek · By Ionut Arghire · 7h ago

The Brief · written from 6 sources

ConnectWise is investigating an active malware campaign against managed service providers that abuses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices.
Researchers report at least 288 endpoints across 48 organizations affected, and ConnectWise says nearly 50 organizations had intrusions.
ConnectWise disabled five third-party ScreenConnect extensions in partner environments; attackers used a flawed legitimate extension to bypass authentication, per SecurityWeek.

Why it matters

Attackers can reach customer machines through trusted MSP remote-management tooling, and the reported campaign has been linked to ransomware deployment, so MSPs and their customers face a wide blast radius.

Who’s affected

MSPs using ConnectWise ScreenConnect
ScreenConnect customers with third-party extensions installed

What to do

Check ScreenConnect environments for unauthorized rogue remote-access clients
Review installed third-party ScreenConnect extensions and disable any that are not needed or trusted

#screenconnect
#msp
#malware
#supply-chain
#ransomware
#remote-access

The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The post Hackers Deploy Malware in Fresh ScreenConnect Campaign appeared first on SecurityWeek .

Read the full story at securityweek.com ↗