The Wave

ConnectWise probes ScreenConnect breaches as worm targets managed service providers

ConnectWise is investigating an active campaign abusing compromised ScreenConnect environments at managed service providers to push rogue remote-access clients to customer devices. It has tied the activity to a third-party RMM+ extension and disabled it across roughly 400 customer environments, with nearly 50 organizations affected. Microsoft Threat Intelligence has detailed a worm called SCKit that abuses hijacked sessions; the items show no scheduled hearing, deadline or vote. · yesterday