Security · High impactFan score 67 · Tier A6 sources

Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs

The Brief · written from 6 sources

ConnectWise is investigating an active malware campaign against managed service providers that abuses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices.
Researchers report at least 288 endpoints across 48 organizations affected, and ConnectWise says nearly 50 organizations had intrusions.
ConnectWise disabled five third-party ScreenConnect extensions in partner environments; attackers used a flawed legitimate extension to bypass authentication, per SecurityWeek.

Why it matters

Attackers can reach customer machines through trusted MSP remote-management tooling, and the reported campaign has been linked to ransomware deployment, so MSPs and their customers face a wide blast radius.

Who’s affected

MSPs using ConnectWise ScreenConnect
ScreenConnect customers with third-party extensions installed

What to do

Check ScreenConnect environments for unauthorized rogue remote-access clients
Review installed third-party ScreenConnect extensions and disable any that are not needed or trusted

#screenconnect
#msp
#malware
#supply-chain
#ransomware
#remote-access

Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments. Security outfit Huntress first raised the alarm in a…

Read the full story at theregister.com ↗