WORLDTECHConnectWise probes malware campaign hitting MSPs via ScreenConnect
AI illustrationConnectWise is investigating an active malware campaign that targets managed service providers (MSPs) by abusing compromised ScreenConnect remote desktop environments. According to the report by BleepingComputer, attackers use these environments to push rogue remote-access clients onto customer devices.
What ConnectWise is investigating
ConnectWise is looking into an ongoing malware operation aimed at managed service providers, the IT firms that remotely administer systems on behalf of their clients. The campaign runs through ScreenConnect, the remote desktop software ConnectWise makes available to such providers.
The attackers take over ScreenConnect environments that have already been compromised and use them to install unauthorised remote-access clients on customer devices. Because those clients give the attackers a foothold on machines the provider manages, a single breached provider can expose the systems of its customers.
What is confirmed and what is not
The available reporting rests on a single outlet, BleepingComputer, which describes the campaign as active. The facts do not give the number of affected providers or customers, the timing of the first intrusions, or the identity of those behind the operation, and this report does not add any of these.
Open questions
- How many managed service providers and customer devices have been affected so far?
- How did attackers first gain access to the compromised ScreenConnect environments?