Active ScreenConnect attacks breach MSPs and impact dozens of organizations
ConnectWise is investigating an active malware campaign against managed service providers (MSPs) that uses compromised ScreenConnect environments to install rogue remote-access clients on customer devices. Security firm Huntress identified six compromised MSPs and 286 affected endpoints across 47 organizations, a number that keeps rising. ConnectWise disabled five third-party extensions across about 400 partner environments as a precaution. Attackers use ScreenConnect's Run Command feature; Huntress points to abuse of legitimate functionality and cites compromised credentials or hijacked operator sessions.
In 35 seconds
- Huntress reports 6 compromised MSPs and 286 affected endpoints across 47 organizations, with numbers rising
- ConnectWise disabled five third-party extensions across about 400 partner environments as containment
- Attackers use ScreenConnect's Run Command to deploy unauthorized remote-access clients
Read the full story at BleepingComputer
IASummary generated by artificial intelligence from a story by BleepingComputer. It may contain errors: the original source prevails.
Comments
Be respectful. Comments reported by several people are hidden until a moderator reviews them.
You do not need an account to read, only to comment. Sign in with a code sent to your email or with your Google account. We only show the name you choose, never your email.