US EditionConnectWise Compromised by 'Sophisticated' Nation State
- In November 2024, ConnectWise experienced a cyberattack that compromised its systems and affected a very limited number of customers using cloud-based ScreenConnect instances.
- The breach occurred due to suspicious activity linked to a sophisticated nation-state actor, leading ConnectWise to launch an investigation with forensic experts Mandiant and coordinate with law enforcement.
- ConnectWise addressed two critical security issues, including CVE-2025-3935, a high-severity vulnerability involving ViewState code injection found in ScreenConnect releases up to version 25.2.3. This flaw could enable remote code execution if an attacker first obtains the machine keys.
- The company implemented enhanced monitoring and security hardening across its environment and reported no further suspicious activity since the patch deployment while notifying all affected customers.
- The incident highlights risks in remote access solutions widely used by managed service providers and IT teams, suggesting ongoing threats from nation-state actors exploiting software vulnerabilities.
Insights by Ground AI
Does this summary seem wrong?
Coverage Details
Total News Sources12
Leaning Left1Leaning Right0Center4Last UpdatedBias Distribution80% Center
Bias Distribution
- 80% of the sources are Center
80% Center
L 20%
C 80%
Factuality
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
