Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

News

Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

Why it’s here: Original technical threat reporting on a worm-like campaign abusing a remote-management platform's third-party extension, with ties to a prior China-state supply-chain attack on the same vendor, bearing directly on cybersecurity policy and critical-infrastructure supply-chain security.

Trace across the board

Item

2d agoCyberScoop · research by HuntressRogue remote-access campaign spread through ScreenConnect add-on, researchers sayHuntress reports an intruder abused a third-party RMM+ extension in cloud-hosted ScreenConnect partner panels to push attacker-controlled ScreenConnect clients to at least 288 computers across 48 organizations, prompting ConnectWise to disable five extensions.
4 articles · The Register
1. 3d agoSecurityWeekPickupHackers Deploy Malware in Fresh ScreenConnect Campaign
2. 3d agoThe RegisterPickupHackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
3. 3d agoCybersecurity DivePickupConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users
4. 2d agoCyberScoopEarliestRogue remote-access campaign spread through ScreenConnect add-on, researchers say
Cyber32 linked

Coverage

4 outlets · first seen 3d ago

Connected

11 links

NewsConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizationsBoth involve Microsoft, Huntress, RMM platform
NewsHackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCsBoth involve Huntress, RMM platform, SCKit
NewsHackers Deploy Malware in Fresh ScreenConnect CampaignBoth involve Huntress, RMM platform, SCKit
NewsSCKit abuses ScreenConnect to deploy remote access and target technician sessionsBoth involve RMM platform, ConnectWise, ScreenConnect
NewsActive ScreenConnect attacks breach MSPs, impact dozens of organizationsBoth involve ConnectWise, ScreenConnect
NewsConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect usersBoth involve ConnectWise, ScreenConnect
NewsFBI warns ARTEX AI hacking tool is powering global cyberattacksBoth involve Microsoft, Huntress, ARTEX AI
NewsARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors | Wiz BlogBoth involve Microsoft, Huntress, ConnectWise
NewsFBI flash alert says Artex tool automating cyberattacks at ‘machine speed’Both involve Microsoft, ConnectWise
NewsN-able issues hotfix after researcher dumps PoCs in disclosure spatBoth involve RMM platform
NewsN-able N-central gets emergency fix two days after 33 exploits publishedBoth involve Microsoft, Huntress

About

Microsoft
Huntress
RMM platform
ARTEX AI
SCKit
ConnectWise
ScreenConnect

The Wave

Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

Item

Coverage

Connected

About

Subscribe

Cookies