AI Image
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
BleepingComputer • • technology
Key Points:
- ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) by abusing compromised ScreenConnect environments to deploy unauthorized remote-access clients to customer devices.
- Huntress discovered six compromised MSPs and 286 affected endpoints across 47 organizations, noting that attackers use ScreenConnect's Run Command feature to install rogue clients, potentially compromising MSP technician workstations during sessions.
- ConnectWise disabled five third-party ScreenConnect extensions linked to the attacks across 400 partner environments as a precaution, warning that disabling these extensions does not remove existing malware or unauthorized access.
- Indicators of compromise include specific rogue client IDs, attacker infrastructure IPs and domains, and malicious scripts; MSPs are urged to review logs, avoid interactive sessions with suspicious devices, and monitor for signs of compromise.
- An earlier related malware campaign from July 2026 involved a batch script using one of the rogue client IDs for persistence and command execution, though the connection to the current attacks remains unclear.
