Late on Wednesday evening, ConnectWise said it believes the activity is related to the abuse of an independent third-party extension installed in customer environments. The tool, RMM+, is an extension for ConnectWise ScreenConnect that allows external management tools to automate and control remote sessions through an API.
“We identified approximately 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed. Their presence alone does not establish compromise,” the company said.
“These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup.”
