Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the time, its security operations center was tracking six compromised managed service providers (MSPs) and more than 286 affected endpoints, with the numbers still climbing.
ConnectWise acquired popular remote supporttool ScreenConnect in February, 2015. Huntress spotted the attacks at around 1747 UTC, when someone began using ScreenConnect's remote command feature to install rogue clients on machines managed by multiple IT service providers.
All 288 endpoints were hit within 90 minutes, with roughly a third compromised in the first ten minutes. Huntress suspects more MSPs may have been compromised, as the attackers appeared to be numbering their victims sequentially, with the numbers suggesting earlier attacks that it hadn't detected. The attackers deployed a 16-file malware toolkit dubbed SCKit, which installs a separate ScreenConnect client to maintain remote access even if the legitimate connection is shut down.
