ConnectWise is currently spearheading an investigation into an active, high-stakes malware campaign that leverages compromised ScreenConnect environments to infiltrate managed service providers (MSPs) and their client networks. By exploiting the legitimate remote management capabilities of the ScreenConnect platform, attackers have successfully deployed rogue remote-access clients, granting them unauthorized persistence and control over numerous endpoints across the managed services ecosystem.
The scope of this campaign is significant, with security firm Huntress identifying hundreds of affected devices across dozens of organizations. As the investigation progresses, evidence suggests that the threat actors are not exploiting a software vulnerability in the traditional sense, but rather weaponizing built-in administrative features to facilitate unauthorized lateral movement and system control.
The Mechanics of the Attack
At the core of this operation is the abuse of the Run Command functionality inherent in ScreenConnect. This feature, designed to allow IT administrators to execute scripts or commands on remote systems, is being redirected to deliver malicious payloads. Once access to a ScreenConnect instance is established, the attackers use it to install unauthorized remote-access clients. These rogue clients operate outside the official, monitored channels of the MSP, effectively hiding from standard oversight tools while maintaining a backchannel into the victim’s machine.
Perhaps the most critical aspect of this incident is the potential for cross-contamination. Researchers have observed instances where technician workstations become compromised during the course of an interactive session with an already infected customer machine. This creates a dangerous feedback loop; a compromised end-user device acts as a vector to infect the technician managing it, potentially granting the attacker credentials or session tokens that allow them to jump into other managed environments.
Immediate Containment Measures
In response to these findings, ConnectWise has taken proactive steps to mitigate further unauthorized access. The company identified five specific third-party extensions that appear to facilitate the attack: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. As a precautionary containment measure, ConnectWise has disabled these extensions across approximately 400 cloud-hosted partner environments.
ConnectWise has clarified that while the disabling of these extensions is a necessary step, it does not act as a complete remediation for systems that have already been breached. The company maintains that the presence of these extensions does not automatically confirm a network compromise, but their removal limits the attacker’s ability to deploy further unauthorized software. For organizations hosting their own on-premises instances of ScreenConnect, manual intervention is required to disable these extensions, as remote administrative action from ConnectWise is limited by the server’s local configuration.
Proactive Threat Hunting and Indicators of Compromise
Both Huntress and ConnectWise have released extensive guidance to assist MSPs in detecting signs of intrusion. Security teams are urged to perform a rigorous audit of their ScreenConnect logs. Key areas of focus include authentication history, extension installation records, administrative activity logs, and the specific history of Run Commands executed within the platform.
The intelligence gathered by researchers has provided several specific indicators of compromise (IOCs) that security teams should monitor. These include specific C2 domains—such as newnewnew.gotdns.org and soxnewwork.homedns.org—and the identification of specific rogue ScreenConnect client IDs, such as 2588ef5c15954b10 and ed630cc2c873b091. The presence of specific file patterns, including scripts labeled “Panel-Lateral.ps1” and “Run-Lateral-Full.bat,” should be treated as high-confidence evidence of a security incident. Because the attackers utilize sequential tagging for their rogue clients, there is a high probability that more organizations have been targeted than the currently confirmed list suggests.
Long-term Implications of RMM Abuse
The discovery of a malicious batch script from July 2026 that references one of the same rogue client IDs suggests that this threat actor has been refining their techniques for several months. By shifting from traditional phishing-led distribution to the exploitation of Remote Monitoring and Management (RMM) platforms, attackers gain a significant advantage in the “dwell time” they can achieve inside a target network. When a piece of malicious software is delivered via an enterprise-grade support tool, it is more likely to evade signature-based detection and heuristic behavioral analysis.
This campaign serves as a critical reminder of the risks associated with the software supply chain. MSPs rely on tools like ScreenConnect as the “keys to the kingdom.” When those tools are abused, the entire trust architecture of the service provider is undermined. The incident underscores why security professionals must implement a principle of least privilege, even for tools that require high-level administrative access.
Recommendations for MSPs
Moving forward, the cybersecurity community recommends that all ScreenConnect users adopt a heightened state of vigilance. This includes, but is not limited to, the following actions:
First, avoid initiating interactive remote control sessions with devices that show any signs of suspicious behavior. Instead, use out-of-band security tools to scan and verify the integrity of the endpoint. Second, conduct a deep dive into logs related to the Toolbox and Run Command features to identify any unauthorized tasks performed recently. Finally, if any of the identified malicious file indicators or C2 domains are detected, immediate isolation of the affected host is necessary to prevent lateral movement.
As of the latest updates, ConnectWise remains in constant communication with the security community to trace the full extent of this campaign. For MSPs, the immediate priority is to verify the health of their internal environments and ensure that no lingering backdoors exist from previous, unidentified interactions with the attacker’s infrastructure. The ongoing nature of this investigation highlights the necessity of continuous monitoring rather than point-in-time security audits.
Disclaimer: This content is auto-generated for informational purposes only.
Source: Read Original News
