ScreenConnect campaign compromises MSPs and customer devices
Original title: Active ScreenConnect attacks breach MSPs, impact dozens of organizations
Huntress reports six compromised MSPs and 286 endpoints across 47 organizations, with the victim count still rising.
ConnectWise is investigating an active malware campaign that uses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices. Huntress, which discovered the activity Wednesday, identified six compromised MSPs and 286 affected endpoints across 47 organizations. As a precaution, ConnectWise disabled five third-party ScreenConnect extensions across about 400 partner environments.
Unconfirmed: ConnectWise says the disabled extensions may be associated with the attacks; that link is unconfirmed.
- Huntress says the number of victims continues to rise.
- ConnectWise warned the five disabled extensions may be tied to the attacks.
- The campaign places rogue remote-access clients on MSP customer devices.
Impact: Rogue remote access deployed on MSP customer devices
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | — |
- 1.Review third-party ScreenConnect extensions after ConnectWise disabled five across about 400 partners.
- Vendors
- ConnectWise
- Products
- ScreenConnect
- Organizations
- Huntress
From the original article
2 min read at databreaches.netLawrence Abrams reports: ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.