ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across about 400 partner environments as a precaution, warning that they may be associated with the attacks. The campaign was first discovered Wednesday by cybersecurity firm Huntress, which says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations, and that the number of victims continues to rise.
"Our SOC is working an active campaign that started around 17:47 UTC today targeting cloud-hosted ScreenConnect instances," Huntress posted to Reddit. "We are currently tracking 6 compromised MSPs and 286+ endpoints, and those numbers are climbing. ConnectWise is engaged and working this with us."
