[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_2P6iWQvyrZ52nCbR_H2_iauXRUP4_0yv1-kaMhPEL8":3},{"article":4,"iocs":49,"watch_terms":78,"solutions":79,"lesson":171},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"9fb67ee3-cbeb-4ca1-b535-dd866f02475b","Active ScreenConnect attacks breach MSPs, impact dozens of organizations","active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations-8ecf3d","ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]","ConnectWise is investigating a malware campaign targeting MSPs by compromising ScreenConnect environments to deploy rogue remote-access clients. Huntress identified six compromised MSPs and 286 affected endpoints across 47 organizations, with numbers increasing. Attackers use ScreenConnect's Run Command to deploy clients and may pivot to MSP technician workstations.","Active malware campaign exploits ScreenConnect to target MSPs, impacting dozens of organizations.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Factive-screenconnect-attacks-breach-msps-impact-dozens-of-organizations\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F16\u002FScreenConnect.jpg","2026-11-11T22:56:21+00:00","2026-11-11T23:00:23.202595+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":25},"MSP","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":26,"icon":28,"name":29,"slug":30},null,"Threat Intelligence","threat-intelligence",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[50,54,58,60,63,66,69,73,76],{"type":51,"value":52,"context":53},"ip","185.99.255.28","Attacker relay",{"type":55,"value":56,"context":57},"domain","newnewnew.gotdns.org","C2 domain",{"type":55,"value":59,"context":57},"soxnewwork.homedns.org",{"type":55,"value":61,"context":62},"cdn007-digitaldownloads.com","Possible additional C2",{"type":55,"value":64,"context":65},"sc.payproofkit.com","Secondary C2",{"type":51,"value":67,"context":68},"155.94.150.39","Secondary C2 IP",{"type":70,"value":71,"context":72},"url","https:\u002F\u002Fns.mo7sen.dev\u002FEadF.php?p=4","Stager URL",{"type":41,"value":74,"context":75},"2588ef5c15954b10","Rogue ScreenConnect client ID",{"type":41,"value":77,"context":75},"ed630cc2c873b091",[21,18],{"controls":80,"vendors":167},[81,109,138],{"slug":82,"name":83,"problem":84,"products":85},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[86,93,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":82,"product_name":90,"url":91,"description":92},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":110,"name":111,"problem":112,"products":113},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":139,"name":140,"problem":141,"products":142},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[168],{"slug":144,"name":145,"logo_path":146,"roles":169},[170],"reported_by",{"slug":172,"title":173,"body":174,"framework_refs":175,"framework_notes":181},"screenconnect-compromise-cascades-through-msps-to-dozens-of-client-organizations","ScreenConnect Compromise Cascades Through MSPs to Dozens of Client Organizations","Attackers exploited compromised ScreenConnect environments to deploy rogue remote-access clients across MSP-managed networks, turning a trusted tool into an attack vector. Because MSPs act as a force multiplier — managing infrastructure for many organizations simultaneously — a single point of compromise cascaded to 286 endpoints across 47 organizations. Attackers also targeted MSP technician workstations, threatening to gain even broader administrative access to client environments. This incident illustrates the critical risk of supply chain trust: clients implicitly trust their MSP's tooling, making MSP platforms high-value targets that require the same security rigor as the clients themselves.",[176,177,178,179,180],"MITRE ATT&CK T1219: Remote Access Software","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(j)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(d)":182,"NIS2 Article 21(2)(j)":183,"MITRE ATT&CK T1219: Remote Access Software":184,"NIST SP 800-53 SI-3: Malicious Code Protection":185,"CIS Control 12: Network Infrastructure Management (v8)":186},"This point requires organizations to manage security risks arising from supplier and service-provider relationships, directly applicable since the attack propagated through MSPs as a trusted supply chain entry point.","Requiring MFA and secured communications for administrative access would have limited attackers' ability to authenticate to ScreenConnect consoles and pivot to technician workstations.","Attackers abused ScreenConnect's legitimate Run Command feature to deploy rogue remote-access clients, matching this technique's definition of adversaries using valid remote access tools maliciously.","Endpoint protection capable of detecting rogue remote-access client installations on managed endpoints would have identified the malicious deployments earlier in the attack chain.","Proper network segmentation between MSP management infrastructure and client environments would have contained the blast radius, preventing a single ScreenConnect compromise from reaching 47 organizations."]