On a Wednesday evening in November, a security watch noticed unfamiliar remote-access tools appearing on machines they had no business touching, and the trail led back to the quiet trust that managed service providers place in the software they use to care for other people's computers. ScreenConnect, a tool meant to help technicians help others, has become the path by which intruders slip into many organizations at once, reaching six providers and hundreds of devices so far, with the count still climbing. No flaw was broken to make this happen; the attackers simply borrowed the instruments of
Active ScreenConnect Campaign Breaches MSPs as Rogue Remote-Access Clients Spread to Customer Devices
Abuse of legitimate functionality, not a software flaw
Mark
Why does this one matter more than a typical malware story?
Mimi
Because the target is the MSP. Each compromised provider is a doorway into its customers, and Huntress counts 47 organizations already.
Mark
And no vulnerability is involved?
Mimi
Brandt says it looks like abuse of legitimate functionality. Run Command doing what it was built to do, in the wrong hands.
Luke
Worth noting that's Huntress's assessment. Nobody has explained how the attackers got into the MSP environments. Credentials or hijacked sessions is what telemetry suggests, not a confirmed finding.
Mark
What about the technician workstations?
Mimi
That's the scarier path, since a technician's machine holds access to many customers. ConnectWise says it has reports of it happening.
Luke
But those reports are unconfirmed, and the mechanism hasn't been explained publicly. I'd treat it as a warning, not an established fact.
Mark
Do the disabled extensions fix anything?
Mimi
No. ConnectWise says it's containment only, and on-premises customers have to disable them by hand.
Luke
Also, ConnectWise only says the extensions are suspected. Having one installed doesn't prove compromise.
Mark
And the July script?
Mimi
It shares a client ID and a possible C2 domain with the current campaign.
Luke
Which suggests overlap, but Huntress wouldn't comment and the link is explicitly unclear. The 286 endpoints figure is also Huntress's count and still moving.
El Pulso
- Huntress has tracked six compromised MSPs and more than 286 endpoints across 47 organizations, and the number is still rising.
- Attackers are using ScreenConnect's own Run Command feature to push rogue remote-access clients onto customer machines outside the providers' legitimate environments.
- ConnectWise has disabled five third-party extensions across roughly 400 partner environments, but warns that this alone does not purge malware already in place.
- Technician workstations may be infected when they open sessions with compromised devices, and that danger is still being confirmed.
- Investigators have not yet found how the intruders first got into the MSP environments, and older attacker traces suggest the campaign may have started earlier than anyone has admitted.
On a Wednesday evening in November, a security watch noticed unfamiliar remote-access tools appearing on machines they had no business touching, and the trail led back to the quiet trust that managed service providers place in the software they use to care for other people's computers. ScreenConnect, a tool meant to help technicians help others, has become the path by which intruders slip into many organizations at once, reaching six providers and hundreds of devices so far, with the count still climbing. No flaw was broken to make this happen; the attackers simply borrowed the instruments of ordinary support work, and how they first crossed the threshold remains a question no one has yet answered.
Late on Wednesday, Huntress began noticing rogue ScreenConnect clients turning up on endpoints it monitors. What started as a handful of odd installations became an active campaign aimed at cloud-hosted ScreenConnect instances, and by the time the picture sharpened, the firm counted six compromised managed service providers, more than 286 affected endpoints, and 47 organizations caught in the spread. Because MSPs use ScreenConnect to reach into many customers' systems, one breached provider can carry trouble into a long chain of downstream businesses.
The attackers are not exploiting a software bug. According to Huntress, they are abusing ScreenConnect's Run Command feature to install unauthorized clients on managed machines, giving them a back door that sits entirely outside the provider's own environment. The more troubling possibility is that a technician who opens a session with an infected device can have their own workstation compromised. Spike Brandt of Huntress described the activity as misuse of legitimate functions, aided by custom tools sometimes built on the victim's machine. Telemetry suggests stolen credentials or hijacked operator sessions, but the entry point into the MSP environments is still unknown.
ConnectWise confirmed unauthorized access to partner accounts and disabled five extensions across about 400 partner environments, cautioning that this does not remove what is already installed. On-premises customers must act on their own, and technicians have been urged to avoid interactive sessions with suspect devices. Huntress, for its part, has shared indicators of compromise and warned that sequential attacker tags hint other providers may already be affected, so anyone using Run Command should review its history now. An earlier batch script disguised as a Social Security statement may connect to the same infrastructure, though that link remains unclear. For now, the work is inventory, audit, and caution.
At about 17:47 UTC on Wednesday, the security firm Huntress began seeing something odd on endpoints it monitors: rogue ScreenConnect clients appearing where they had no business being. Its security operations team started working what it called an active campaign aimed at cloud-hosted ScreenConnect instances, and posted a notice on Reddit saying so. At that point it was tracking six compromised managed service providers and more than 286 endpoints, with the numbers climbing.
By the time the picture firmed up, Huntress put the toll at six compromised MSPs and 286 affected endpoints across 47 organizations, and said the count was still rising. ScreenConnect, made by ConnectWise, is a remote access and support platform that MSPs and IT teams use to manage and troubleshoot customer devices, which is why a breach of one provider can reach many downstream organizations.
According to Huntress, the attackers are using ScreenConnect's Run Command function to push rogue ScreenConnect clients onto managed endpoints. Those clients give the intruders remote access outside the legitimate MSP's own ScreenConnect environment. Huntress also flagged a potentially worse technique: an MSP technician's workstation can be compromised when the technician opens a ScreenConnect session with an infected customer device. How malware moves from the endpoint to the technician's machine has not been publicly explained.
Spike Brandt, Principal Threat Intelligence Incident Commander at Huntress, told BleepingComputer the activity appears to be abuse of legitimate functionality, not exploitation of a software vulnerability. He said it is aided by custom tooling that is sometimes compiled on the fly on the victim's computer, and that Huntress has no information on how a "patient zero" machine would have started the attack. Huntress says its telemetry points to compromised credentials or hijacked operator sessions, but it has not determined how attackers got into the MSP environments. Because it retrieved attacker scripts that were still accessible, it could study how the attacks worked.
In a security advisory published Wednesday night, ConnectWise confirmed unauthorized access to ScreenConnect partner accounts and the installation of unauthorized remote-access software in customer environments. It suspects the threat actor deployed additional remote-access software through independent third-party extensions that partners added from the built-in Extensions marketplace. As a precaution, it disabled five such extensions across roughly 400 partner environments: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link.
ConnectWise stressed that having one installed does not mean a network was compromised, and that the move does not remove unauthorized software, persistence mechanisms or access already on affected devices. On-premises customers must disable the extensions themselves, since ConnectWise cannot do it for them, and partners were told not to re-enable or reinstall them until further guidance arrives. The company advised reviewing authentication logs, extension installation records, administrative activity, Run Command history and Toolbox records, and urged technicians to avoid interactive sessions with possibly compromised devices and use separate security tools instead. It has received reports of technician workstations being compromised during such sessions, still being confirmed, and says it has no reason to believe partners without the five extensions are affected.
Huntress warned that sequential attacker-assigned tags suggest other MSPs may have been compromised earlier, so users should check Run Command history even without alerts. It shared indicators of compromise, including an attacker relay at 185.99.255[.]28, command-and-control domains such as newnewnew.gotdns[.]org and soxnewwork.homedns[.]org, rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091, an attacker name of "Addmin," and files including Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe and Run-Lateral-Full.bat. It has contacted ConnectWise, the VPS provider hosting the attacker infrastructure, the dynamic DNS providers used, and the wider MSP community.
BleepingComputer also found an earlier batch script, SSA-2026-STATEMENT-15518787.bat, first uploaded to VirusTotal on July 25, 2026, that references one of those client IDs. Its name suggests a Social Security Administration statement lure. It adds Microsoft Defender exclusions, sets up persistence, fetches installers from cdn007-digitaldownloads[.]com, which Huntress lists as a possible C2 domain, and then checks for ed630cc2c873b091 and notifies the attackers via Telegram. Huntress declined to comment on that July incident but said it has seen a significant rise in 2026 attacks using legitimate RMM software as an initial payload. How the July activity relates to the current campaign remains unclear.
Citas Notables
This appears to be abuse of legitimate functionality, aided using custom-built tooling that is, in some cases, compiled on the fly on the victim's computer.— Spike Brandt, Huntress
Disabling these extensions is a precautionary containment measure and does not establish that unauthorized software or access has been removed.— ConnectWise advisory (paraphrased)
Quieres la nota completa?
Lee el original en BleepingComputer ↗