Hackers hijack ScreenConnect servers, breach dozens of companies

A serious malware campaign is actively targeting managed service providers (MSPs) using ConnectWise's ScreenConnect software. Attackers compromised MSPs' ScreenConnect environments and used them to install malicious remote-access clients on devices belonging to those MSPs' customers, effectively giving the attackers a backdoor. The campaign, detected by cybersecurity firm Huntress, has already impacted at least six MSPs and 286 endpoints across 47 organizations, with victims continuing to increase.

ScreenConnect is widely used by IT support teams to remotely manage computers, making this breach particularly dangerous as it turns a legitimate admin tool into an attack vector. The attackers used ScreenConnect's built-in 'Run Command' feature to deploy rogue clients. There are also warnings about a reverse-pivot technique where an infected customer device could compromise the MSP technician's own workstation during a support session. ConnectWise has advised partners to avoid interactive sessions with suspected compromised devices, review account activity, revoke sessions, and reset credentials. This incident highlights the devastating cascading risk when a central IT management platform is compromised.

What to do: Avoid interactive ScreenConnect sessions to suspected compromised devices, review account activity, revoke active sessions, reset credentials from a trusted device, and verify multifactor authentication.