Published • loading... • Updated
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
Huntress says six MSPs and 286 endpoints are affected as attackers use ScreenConnect’s Run Command feature to deploy rogue remote-access clients.
- On Wednesday, cybersecurity firm Huntress discovered an active campaign targeting cloud-hosted ScreenConnect instances used by managed service providers to remotely manage customer devices.
- Attackers are leveraging compromised credentials and hijacked support sessions to deploy unauthorized remote-access clients, though Huntress has not yet determined the exact initial access method.
- The ongoing campaign has affected 6 MSPs and 286 endpoints across 47 organizations, with Huntress warning the figures continue climbing as the situation evolves.
- ConnectWise is investigating the malicious activity and urged partners to avoid interactive remote sessions, review account activity, revoke sessions, reset credentials, and verify multifactor authentication.
- Researchers warned of a 'potentially more dangerous' reverse-pivot technique where attackers can infiltrate an MSP technician's workstation when initiating a ScreenConnect session with an infected device.
Insights by Ground AI
Podcasts & Opinions
17 Articles
17 Articles
BleepingComputer+4 Reposted by 4 other sources
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]
·Melville, United States
Read Full Article
A third-party extension for ScreenConnect would have allowed you to run commands with a blank access key. The campaign reached at least 288 teams and ConnectWise identified about 400 environments with extensions of the RMM+ family, although the presence of one extension does not mean that everyone has been compromised.
Coverage Details
Total News Sources17
Leaning Left0Leaning Right0Center4Last UpdatedBias Distribution100% Center
Bias Distribution
- 100% of the sources are Center
100% Center
C 100%
Factuality
To view factuality data please Upgrade to Premium
