Security firm Huntress spotted an active campaign on Wednesday against cloud-hosted ScreenConnect instances, the remote access tool that MSPs and IT teams use to manage customer computers. The attackers use the tool's command feature to install rogue ScreenConnect clients on customer machines, giving them remote access outside the provider's legitimate environment. According to Huntress, six providers and more than 286 computers at 47 organizations have been hit so far.
In a security advisory, ConnectWise confirmed unauthorized access to partner accounts and the installation of unauthorized remote access software. The company suspects five independent third-party extensions installed from the ScreenConnect extensions marketplace, and disabled them as a precaution across about 400 partner environments. According to Huntress, the attacks abuse legitimate features rather than exploit a software vulnerability.
It is still unknown how the intrusion began, and how the malware spreads from a customer machine to a technician's workstation has not been fully explained. Organizations that work with a provider using ScreenConnect should check with the provider whether it was affected, review installed extensions, and look for unfamiliar remote access clients on their computers.