ConnectWise confirms unauthorised access to ScreenConnect accounts used against IT providers' clients

ConnectWise has confirmed unauthorised access to ScreenConnect partner accounts, its remote support platform, and the installation of unauthorised remote-access software in customer environments, according to the company's security advisory reported by BleepingComputer.

The campaign was detected on Wednesday by security firm Huntress, which says it has identified six compromised managed service providers and 286 affected endpoints across 47 organisations, and that the number keeps rising. According to Huntress, the attackers use ScreenConnect's command execution feature to install remote clients outside the legitimate provider's control; the activity began at around 17:47 UTC.

As a precaution, ConnectWise has disabled five third-party extensions across about 400 partner environments, because it suspects the attacker used them to deploy the remote-access software, according to BleepingComputer.

A Huntress official told that outlet that it appears to be abuse of legitimate functionality rather than exploitation of a vulnerability, and that it is not known how the first infected machine originated. The campaign has not been attributed to any actor.

Developing story: the ConnectWise advisory and the Huntress report still need to be opened directly; the victim figures are provisional and, according to Huntress, still rising.