Attackers use hacked ScreenConnect setups at IT service providers to plant rogue remote-access clients on customer machines
Huntress is tracking six compromised managed service providers and nearly 300 affected endpoints. ConnectWise has turned off five third-party extensions in about 400 partner environments.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
ConnectWise is investigating an active malware campaign that targets managed service providers (MSPs), outside firms that run IT for other organizations, through their cloud-hosted ScreenConnect environments. ScreenConnect is a remote access and support platform that MSPs and IT teams use to manage and troubleshoot customer devices. Security firm Huntress found the campaign on Wednesday and said it began around 17:47 UTC. According to Huntress, the attackers use ScreenConnect's Run Command feature to install rogue ScreenConnect clients on managed endpoints. Those clients give the attackers remote access that sits outside the MSP's legitimate ScreenConnect environment. Huntress initially reported six compromised MSPs and more than 286 affected endpoints across 47 organizations, and said the numbers were still rising. A later report from The Hacker News puts the count at at least 288 endpoints across 48 organizations. As a precaution, ConnectWise has disabled five third-party ScreenConnect extensions in about 400 partner environments, warning that they may be linked to the attacks. Because a single MSP can manage many client networks, a breach at the provider can spread to its customers. MSPs and their customers should look for unexpected ScreenConnect clients and review recent Run Command activity.