← Back to the board
Issue file · activeTracking since Nov 11 · 3 articles · 3 outlets
ConnectWise probes ScreenConnect breaches as worm targets managed service providers
Tracking: ScreenConnect malware campaign and MSP remote access securityPolicy matter covering the active malware campaign abusing compromised ScreenConnect environments at managed service providers to push rogue remote-access clients onto customer devices, including vendor disclosure and investigation obligations, MSP security requirements, CISA advisories and federal remediation guidance, and security standards for remote monitoring and management tools used by managed service providers.
Cyber
Articles · 14 days
- Earliest seen
- Nov 11
- BleepingComputer · Wednesday, Nov 11
- Articles · 30d
- 3
- 1.0 per story
- Outlets
- 3
- Most: Microsoft Security Blog (1)
- Hill · 30d
- 0
- None in 30 days or ahead
- Contracts · 30d
- 0
- No awards or solicitations
- Momentum
- 0.4
- Articles ▲3 vs prior week
Activity
30 days back, 14 ahead · hollow = scheduledWhat's happening
Updated yesterdayConnectWise is investigating an active campaign abusing compromised ScreenConnect environments at managed service providers to push rogue remote-access clients to customer devices. It has tied the activity to a third-party RMM+ extension and disabled it across roughly 400 customer environments, with nearly 50 organizations affected. Microsoft Threat Intelligence has detailed a worm called SCKit that abuses hijacked sessions; the items show no scheduled hearing, deadline or vote.
Latest
YesterdayOur first signal
Hill
No policymaker activity in the window.
Contracts
No procurement or funding activity in the window.
Pressure
3 articlesMicrosoft Threat Intelligence opposes the SCKit campaign, while ConnectWise, Huntress and Blackpoint Cyber researchers are cast as neutral voices on the extension compromise, initial access and patch efficacy.
Who covered it, when
A dot per article · ringed = earliest in our sourcesForces at work
share of articles- Threats & findings3 · 100%Microsoft detailed SCKit, a worm abusing hijacked ScreenConnect sessions to install unauthorized clients, persist, and target technician workstations and browser-held console cookies. ConnectWise is probing breaches at nearly 50 organizations tied to a third-party RMM+ extension, now disabled across roughly 400 customer environments.ConnectWise · Microsoft Threat Intelligence · Huntress · Blackpoint Cyber
In the news
3 articlesYesterdayMicrosoft Security BlogOriginalSCKit abuses ScreenConnect to deploy remote access and target technician sessions 3d agoThe RecordOriginalConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations 3d agoBleepingComputerActive ScreenConnect attacks breach MSPs, impact dozens of organizations