ScreenConnect campaign targets MSPs with rogue remote-access clients
ConnectWise is investigating an active malware campaign that targets managed service providers (MSPs) through compromised ScreenConnect environments. The attackers are using those environments to deploy rogue remote-access clients onto customer devices, creating a potential path from an MSP’s systems into the organizations it supports.
The reported impact extends beyond the providers themselves: the campaign has affected dozens of organizations. The available details do not identify the victims, explain how the ScreenConnect environments were compromised, or specify which client systems or software versions are involved. ConnectWise’s investigation is ongoing, and no additional technical indicators or remediation status have been provided in the information available.
Why MSP access can widen the impact
Remote-support platforms are designed to let service providers administer customer endpoints. That trusted relationship can make a compromised management environment especially consequential. If an attacker can use it to introduce a separate, unauthorized remote-access client, the resulting access may be harder to distinguish from legitimate support activity unless customers and providers maintain clear records of approved tools and installations.
The report does not establish how the rogue clients are being used after installation or whether the attackers have accessed particular data, disrupted operations, or maintained persistence. Those outcomes should not be assumed. The confirmed concern is the deployment of unauthorized remote-access software through compromised ScreenConnect environments, with consequences reported across multiple customer organizations.
Steps for MSPs and customers
While ConnectWise investigates, MSPs should review ScreenConnect access and activity for unexpected administrative actions, unfamiliar sessions, and changes that could have led to unapproved software being installed. They should also compare remote-access clients found on managed endpoints against the tools authorized for each customer, and investigate discrepancies through their established incident-response processes.
Customer organizations should ask their service providers whether their environments are affected, what endpoints have been reviewed, and whether any unauthorized remote-access clients were found. Internally, IT teams can inventory remote-management software on endpoints and validate that each installation has a business owner and a legitimate support purpose. These checks are general defensive measures; the available reporting does not say that ConnectWise or affected organizations have prescribed these exact actions.
Both providers and customers should coordinate before removing unfamiliar software or changing access arrangements, so investigations can preserve relevant evidence and legitimate support is not interrupted unnecessarily. Organizations should rely on verified communications from ConnectWise and their MSPs for campaign-specific findings, including any confirmed indicators, affected configurations, or remediation guidance.
What remains unknown
Important questions remain unanswered: how the ScreenConnect environments were compromised, how many MSPs are affected, which customers or endpoint platforms are involved, and whether the unauthorized clients are associated with additional malicious activity. Until investigators provide those details, organizations should avoid treating any particular entry method, product version, or endpoint symptom as confirmed. The incident underscores the need for MSPs and their customers to jointly monitor remote administration pathways and account for every remote-access tool deployed across managed devices.
