ScreenConnect abuse compromises computers at 48 organizations
Attackers exploited a cloud-based ScreenConnect management environment and third-party extensions to install remote access software for their use on at least 288 computers across 48 organizations. ConnectWise disabled five potentially related third-party extensions in approximately 400 partner environments. The company is investigating attacks targeting ScreenConnect users.
Key facts
- Affected organization
- ConnectWise
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Remote access software installed on at least 288 computers across 48 organizations
- Cause / method
- Exploitation of a ScreenConnect management environment and third-party extensions
- Location
- Other countries
Timeline
- The installation of remote access software for attackers on at least 288 computers across 48 organizations and the disabling of five third-party extensions were reported.
- ConnectWise said it was investigating a ScreenConnect compromise involving third-party extensions.
6 related reports
- Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
- Active ScreenConnect attacks breach MSPs, impact dozens of organizations
- ConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users
- ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
- ConnectWise disables third-party extensions, probes ScreenConnect cyberattack
- ConnectWise「ScreenConnect」へ不正アクセス、約400のパートナー環境で拡張機能を緊急無効化
Other incidents at ConnectWise
ConnectWise Cloud Breach Disrupts Services and Gives Access to Customer Environments
Impact: Backup, security and management services disrupted; successful logins confirmed to more than 300 customer Microsoft 365 tenants
ConnectWise's cloud environment was breached, disrupting its backup, security and management services in October 2026. Attackers used existing application permissions to access customers' Microsoft 365 environments, and Huntress confirmed successful logins to more than 300 tenants from related IP addresses. In response to unauthorized access to cloud backup application credentials, related accounts and credentials were reset. Microsoft later said login attempts using AI agents targeted more than 2,250 tenants.
Related reports: 5 · last report →ConnectWise breach puts ScreenConnect customers in attackers' sights
ConnectWise was breached in a cyberattack, and ScreenConnect customers were targeted. Involvement of a nation-state attacker was suspected, and the company confirmed the attack while stating that its systems were secure.
Related reports: 8 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.