Security · High impactFan score 66 · Tier A2 sources
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
The Hacker News ·
The Brief · written from 2 sources
- ConnectWise is investigating an active malware campaign that abuses compromised ScreenConnect environments of managed service providers (MSPs).
- The attackers use these environments to deploy rogue remote-access clients to customer devices; The Hacker News reports at least 288 endpoints across 48 organizations.
- As a precaution, ConnectWise disabled five third-party extensions in partner environments.
Why it matters
Remote-access tools that MSPs use to manage customers can become a route into every customer device they support, so one compromised MSP can affect many organizations.
Who’s affected
- MSPs using ScreenConnect
- Organizations whose devices are managed through ScreenConnect
- #screenconnect
- #msp
- #malware
- #supply-chain
- #remote-access
- #connectwise
ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its…
Timeline
ConnectWise investigates an active malware campaign targeting MSPs via compromised ScreenConnect environments
BleepingComputer
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise disables five third-party extensions in partner environments after reports of unauthorized access
The Hacker News
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients