Breach
ConnectWise investigates active campaign abusing compromised ScreenConnect environments
ConnectWise is investigating an active malware campaign that targets managed service providers, according to the report.
Written by a model from the sources below. Verify against them.
- Vendor
- ConnectWise
- Product
- ScreenConnect
- Status
- Corroborated
- Disclosed
Summary
The campaign reportedly uses compromised ScreenConnect environments to install rogue remote-access clients on customer devices, and the report says dozens of organizations may be affected.
What to do
Audit ScreenConnect instances for unrecognized users, sessions, and remote-access clients
Check endpoints for unexpected ScreenConnect or remote-access software installations
Rotate ScreenConnect and related administrative credentials
Restrict ScreenConnect access to trusted networks and enforce MFA
Timeline
- Made public by BleepingComputer
- First seen by cve.now
Evidence 2
- Socialr/sysadmin
“their MSP told them today that Connectise got breached globally”
- PressBleepingComputer
“ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the ConnectWise breach
Was ConnectWise breached?
BleepingComputer reports it. No statement from ConnectWise has reached cve.now yet.
What should ConnectWise customers do?
Audit ScreenConnect instances for unrecognized users, sessions, and remote-access clients. Check endpoints for unexpected ScreenConnect or remote-access software installations. Rotate ScreenConnect and related administrative credentials. Restrict ScreenConnect access to trusted networks and enforce MFA.