ScreenConnect campaign compromises MSPs and customer endpoints
Original title: Active ScreenConnect attacks breach MSPs, impact dozens of organizations
Huntress is tracking six MSPs and 286 endpoints across 47 organizations, with the count still rising.
ConnectWise is investigating a malware campaign that uses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices. Huntress says six managed service providers and at least 286 endpoints at 47 organizations are affected. Current telemetry points to stolen credentials and hijacked support sessions; whether a software flaw is involved is unclear. ConnectWise told partners to avoid interactive sessions to suspect devices, review activity, revoke sessions, and reset credentials.
Unconfirmed: Initial access is unconfirmed, and it is unclear whether the July script is the same campaign.
- Huntress says activity began around 17:47 UTC on Wednesday.
- Attacker relay listed is 185.99.255.28, hostname screen.
- Rogue client IDs include 2588ef5c15954b10 and ed630cc2c873b091.
- A Social Security-themed script uploaded July 25, 2026 referenced one ID.
Impact: Remote access to MSP-managed customer devices outside legitimate environments
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | — |
- 1.Avoid interactive ScreenConnect sessions to suspected compromised devices.
- 2.Review Run Command history, revoke sessions, and reset credentials from a trusted device.
- 3.Hunt for the listed rogue client IDs, relay, and C2 domains.
- ATT&CK
- T1219 Remote Access ToolsT1078 Valid AccountsT1562.001 Disable or Modify ToolsT1547.001 Registry Run Keys / Startup Folder
- Vendors
- ConnectWise
- Products
- ScreenConnect
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amexsafekeyupdate.com | s Startup folder and the Run registry key. It then contacts amexsafekeyupdate.com to retrieve installation commands for two separate installe |
| domain | cdn007-digitaldownloads.com | ns[.]org , soxnewwork.homedns[.]org Possible additional C2: cdn007-digitaldownloads[.]com Secondary C2: sc.payproofkit[.]com ( 155.94.150[.]39 , ho |
| domain | digitaldownloads.com | wnloads[.]com and cyberrexdesign.screenconnect[.]com , with digitaldownloads[.]com listed by Huntress as a potential IOC. DigitalDownloads S |
| domain | gotdns.org | y: 185.99.255[.]28 (hostname: screen) C2 domains: newnewnew.gotdns[.]org , soxnewwork.homedns[.]org Possible additional C2: cdn007 |
| domain | homedns.org | me: screen) C2 domains: newnewnew.gotdns[.]org , soxnewwork.homedns[.]org Possible additional C2: cdn007-digitaldownloads[.]com Sec |
| domain | mo7sen.dev | 94.150[.]39 , hostname: WIN-FB5CKHMU4E1) Stager: hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Rogue ScreenConnect client IDs: 2588ef5c1595 |
| domain | payproofkit.com | ditional C2: cdn007-digitaldownloads[.]com Secondary C2: sc.payproofkit[.]com ( 155.94.150[.]39 , hostname: WIN-FB5CKHMU4E1) Stager: hx |
| domain | screenconnect.com | llers from cdn007-digitaldownloads[.]com and cyberrexdesign.screenconnect[.]com , with digitaldownloads[.]com listed by Huntress as a pot |
| ipv4 | 155.94.150.39 | digitaldownloads[.]com Secondary C2: sc.payproofkit[.]com ( 155.94.150[.]39 , hostname: WIN-FB5CKHMU4E1) Stager: hxxps://ns.mo7sen[.] |
| ipv4 | 185.99.255.28 | d by the attackers. The indicators include: Attacker relay: 185.99.255[.]28 (hostname: screen) C2 domains: newnewnew.gotdns[.]org , s |
| url | https://ns.mo7sen.dev/EadF.php?p=4 | ]com ( 155.94.150[.]39 , hostname: WIN-FB5CKHMU4E1) Stager: hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Rogue ScreenConnect client IDs: 2588ef5c15954b10 , ed630c |
From the original article
3 min read at bleepingcomputer.com
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.