Active ScreenConnect attacks breach MSPs, impact dozens of organizations
A malware campaign is actively targeting managed service providers (MSPs) by compromising ScreenConnect environments to deploy unauthorized remote-access clients to customer devices. Discovered by Huntress security firm, the attack has compromised six MSPs and affected over 286 endpoints across 47 organizations, with numbers rising. The attackers leverage ScreenConnect's Run Command to install rogue clients, enabling unauthorized remote access outside legitimate MSP control. A concerning technique also allows attackers to potentially compromise MSP technicians’ workstations during sessions with infected devices, although the precise method remains unclear. ConnectWise, the vendor behind ScreenConnect, is investigating and advises partners to avoid interactive sessions with suspected compromised devices, review activity logs, reset credentials, and enforce multifactor authentication. The attackers likely use compromised credentials and hijacked support sessions as initial access vectors, and sequential identifiers hint at additional undetected MSP compromises. Huntress shared multiple indicators of compromise and warns MSPs to audit their Run Command histories thoroughly even if unalerted. Previous activity linked to one rogue client ID suggests months-long malicious use, possibly tied to phishing campaigns, but the connection to current attacks remains unconfirmed.
Linha do tempo
-
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ler a análise desta fonte ocultar
A malware campaign is actively targeting managed service providers (MSPs) by compromising ScreenConnect environments to deploy unauthorized remote-access clients to customer devices. Discovered by Huntress security firm, the attack has compromised six MSPs and affected over 286 endpoints across 47 organizations, with numbers rising. The attackers leverage ScreenConnect's Run Command to install rogue clients, enabling unauthorized remote access outside legitimate MSP control. A concerning technique also allows attackers to potentially compromise MSP technicians’ workstations during sessions with infected devices, although the precise method remains unclear. ConnectWise, the vendor behind ScreenConnect, is investigating and advises partners to avoid interactive sessions with suspected compromised devices, review activity logs, reset credentials, and enforce multifactor authentication. The attackers likely use compromised credentials and hijacked support sessions as initial access vectors, and sequential identifiers hint at additional undetected MSP compromises. Huntress shared multiple indicators of compromise and warns MSPs to audit their Run Command histories thoroughly even if unalerted. Previous activity linked to one rogue client ID suggests months-long malicious use, possibly tied to phishing campaigns, but the connection to current attacks remains unconfirmed.