[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwRdjwWO_Q0rpj-7Org3InmnxJO6uhUTp8r6SkepKSFA":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"3793208e-892c-412d-bd8d-7f4b95ffc921","ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations","connectwise-investigates-screenconnect-breaches-after-reports-of-incidents-at-ne-9b8ad6","Abuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise. Cybersecurity researchers had spotted intrusions at nearly 50.","ConnectWise is investigating breaches affecting nearly 50 organizations that exploited its ScreenConnect tool. The company believes the activity is linked to the abuse of a third-party extension called RMM+, which provides an API for remote command execution. ConnectWise has disabled RMM+ in affected environments and is urging customers to do the same, warning that attackers may have deployed additional remote-access software and compromised technician workstations.","ConnectWise investigates ScreenConnect breaches linked to RMM+ extension exploitation.","https:\u002F\u002Ftherecord.media\u002Fconnectwise-screenconnect-breaches-third-party-tool","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fconnectwise_logo_df3804ab18.jpg","2026-11-12T16:16:00+00:00","2026-11-12T17:00:21.075945+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"RMM+","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":45,"value":46,"context":47},"cve","CVE-2026-84869","Vulnerability exploited in ScreenConnect attacks",[21,18,24],{"controls":50,"vendors":138},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":110,"name":111,"problem":112,"products":113},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[139],{"slug":140,"name":141,"logo_path":142,"roles":143},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":155},"third-party-rmm-extension-abused-to-breach-nearly-50-organizations-via-screenconnect","Third-Party RMM Extension Abused to Breach Nearly 50 Organizations via ScreenConnect","Attackers exploited a third-party extension (RMM+) integrated with ConnectWise ScreenConnect to execute remote commands across nearly 50 organizations, demonstrating how supply chain components can dramatically expand an attack surface. The root cause was the availability of an unsanctioned or insufficiently vetted API extension that granted broad remote execution capabilities without adequate controls. Because technician workstations were also compromised, the breach extended beyond the tool itself into privileged operator environments. This incident illustrates that every third-party plugin, extension, or integration must be treated as a potential attack vector and subjected to the same scrutiny as core software.",[150,151,152,153,154],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","MITRE ATT&CK T1219: Remote Access Software","ISO\u002FIEC 27001:2022 A.8.19: Installation of software on operational systems",{"NIS2 Article 21(2)(d)":156,"MITRE ATT&CK T1219: Remote Access Software":157,"NIST SP 800-53 SA-9: External System Services":158,"CIS Control 2: Inventory and Control of Software Assets (v8)":159,"ISO\u002FIEC 27001:2022 A.8.19: Installation of software on operational systems":160},"NIS2's supply chain security point requires organizations to assess risks introduced by third-party suppliers and service components, which directly applies to the unvetted RMM+ extension that enabled the breach.","Attackers leveraged the RMM+ extension to establish remote access and reportedly deployed additional remote-access tools, matching this technique's description of adversary use of legitimate remote management software.","SA-9 requires organizations to define and enforce security requirements for externally provided services and components, which would have mandated a security review of the RMM+ extension's remote execution API.","Maintaining an inventory of approved software and extensions would have flagged RMM+ as an unapproved or unreviewed third-party component before it could be exploited.","This control requires that procedures govern the installation of software on operational systems, which would have restricted the deployment of an unvetted extension like RMM+ granting broad API-level command execution."]