[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-nqTovZ6AeD_7_Gm4Abia3yiJP1S4gETf0E71CCBKhM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"d475a07a-310a-443b-b421-3b47f53d19f0","third-party-rmm-extension-abused-to-breach-nearly-50-organizations-via-screenconnect","3793208e-892c-412d-bd8d-7f4b95ffc921","Third-Party RMM Extension Abused to Breach Nearly 50 Organizations via ScreenConnect","Attackers exploited a third-party extension (RMM+) integrated with ConnectWise ScreenConnect to execute remote commands across nearly 50 organizations, demonstrating how supply chain components can dramatically expand an attack surface. The root cause was the availability of an unsanctioned or insufficiently vetted API extension that granted broad remote execution capabilities without adequate controls. Because technician workstations were also compromised, the breach extended beyond the tool itself into privileged operator environments. This incident illustrates that every third-party plugin, extension, or integration must be treated as a potential attack vector and subjected to the same scrutiny as core software.","**Immediate actions:**\n- Disable or remove the RMM+ extension (and any unapproved third-party extensions) from all ScreenConnect environments immediately.\n- Audit all technician workstations that may have been exposed and rotate credentials for any accounts accessible from those machines.\n- Review and revoke any additional remote-access software that attackers may have deployed during the breach.\n\n**Long-term improvements:**\n- Establish a formal vetting and approval process for all third-party plugins and extensions before they are permitted in production RMM environments.\n- Apply least-privilege principles to API integrations so that extensions can only perform the specific actions they require, not broad remote command execution.\n- Maintain an accurate, continuously updated inventory of all third-party tools and extensions integrated with critical management platforms.\n\n**Detection measures:**\n- Monitor RMM platforms for anomalous API calls, unusual remote command executions, or connections to unexpected endpoints.\n- Implement endpoint detection and response (EDR) on technician workstations to alert on suspicious process creation or lateral movement originating from management tools.\n- Establish alerts for the installation of new remote-access software across managed environments.",[12,13,14,15,16],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","MITRE ATT&CK T1219: Remote Access Software","ISO\u002FIEC 27001:2022 A.8.19: Installation of software on operational systems",{"NIS2 Article 21(2)(d)":18,"MITRE ATT&CK T1219: Remote Access Software":19,"NIST SP 800-53 SA-9: External System Services":20,"CIS Control 2: Inventory and Control of Software Assets (v8)":21,"ISO\u002FIEC 27001:2022 A.8.19: Installation of software on operational systems":22},"NIS2's supply chain security point requires organizations to assess risks introduced by third-party suppliers and service components, which directly applies to the unvetted RMM+ extension that enabled the breach.","Attackers leveraged the RMM+ extension to establish remote access and reportedly deployed additional remote-access tools, matching this technique's description of adversary use of legitimate remote management software.","SA-9 requires organizations to define and enforce security requirements for externally provided services and components, which would have mandated a security review of the RMM+ extension's remote execution API.","Maintaining an inventory of approved software and extensions would have flagged RMM+ as an unapproved or unreviewed third-party component before it could be exploited.","This control requires that procedures govern the installation of software on operational systems, which would have restricted the deployment of an unvetted extension like RMM+ granting broad API-level command execution.","published","2026-11-12T17:21:51.143068+00:00","2026-11-12T17:21:51.126+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Ftherecord.media\u002Fconnectwise-screenconnect-breaches-third-party-tool","connectwise-investigates-screenconnect-breaches-after-reports-of-incidents-at-ne-9b8ad6","ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]