ScreenConnect campaign compromises six MSPs and reaches 47 organizations

Attackers have compromised six managed service providers and affected 286 endpoints across 47 organizations through ScreenConnect environments, cybersecurity firm Huntress reported Wednesday. ConnectWise confirmed it is investigating and urged partners to avoid interactive remote sessions with suspected compromised devices. Attackers use ScreenConnect's Run Command feature to install rogue clients that provide access outside the legitimate provider's environment. Huntress also warned that connecting to an infected customer device could compromise a technician's workstation. Initial access remains undetermined, although its telemetry points to compromised credentials and hijacked support sessions.