Third-Party RMM Extension Abused to Breach Nearly 50 Organizations via ScreenConnect
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited a third-party extension (RMM+) integrated with ConnectWise ScreenConnect to execute remote commands across nearly 50 organizations, demonstrating how supply chain components can dramatically expand an attack surface. The root cause was the availability of an unsanctioned or insufficiently vetted API extension that granted broad remote execution capabilities without adequate controls. Because technician workstations were also compromised, the breach extended beyond the tool itself into privileged operator environments. This incident illustrates that every third-party plugin, extension, or integration must be treated as a potential attack vector and subjected to the same scrutiny as core software.
Tactical Insight
Immediate actions
- Disable or remove the RMM+ extension (and any unapproved third-party extensions) from all ScreenConnect environments immediately.
- Audit all technician workstations that may have been exposed and rotate credentials for any accounts accessible from those machines.
- Review and revoke any additional remote-access software that attackers may have deployed during the breach.
Long-term improvements
- Establish a formal vetting and approval process for all third-party plugins and extensions before they are permitted in production RMM environments.
- Apply least-privilege principles to API integrations so that extensions can only perform the specific actions they require, not broad remote command execution.
- Maintain an accurate, continuously updated inventory of all third-party tools and extensions integrated with critical management platforms.
Detection measures
- Monitor RMM platforms for anomalous API calls, unusual remote command executions, or connections to unexpected endpoints.
- Implement endpoint detection and response (EDR) on technician workstations to alert on suspicious process creation or lateral movement originating from management tools.
- Establish alerts for the installation of new remote-access software across managed environments.