ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
IT management software company ConnectWise is investigating reports of unauthorized access to its customers after cybersecurity firms reported breaches at nearly 50 organizations through its ScreenConnect tool.
The Tampa-based company said it believes the activity is related to the abuse of an independent third-party extension called RMM+ installed in customer environments. RMM+ is an extension for ConnectWise ScreenConnect that allows external management tools to automate and control remote sessions through an API.
ConnectWise identified approximately 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed. The company disabled RMM+ in these environments and urged customers with on-premises systems to disable it themselves.
Attack details
ConnectWise told customers that threat actors were deploying additional remote-access software and saw potential compromise of technician workstations during interactive connections to affected devices. The company warned that disabling extensions and resetting credentials alone may not remove unauthorized software or established access.
Huntress reported seeing 288 affected endpoints across 48 organizations targeted within 90 minutes. The cybersecurity firm found commands tied to RMM+ across several ScreenConnect systems and confirmed that ConnectWise disabled RMM+ alongside four other third-party extensions.
Huntress hasn't seen evidence of a new vulnerability, but it's still unclear how the attacker got panel access. Current telemetry points to compromised credentials or hijacked operator sessions to gain initial access.
Vulnerability connection
Researchers from Blackpoint Cyber confirmed that the attack toolkit used by threat actors exploits CVE-2026-84869, a ConnectWise vulnerability discovered in September that was already being exploited according to the Cybersecurity and Infrastructure Security Agency.
The researchers tested the toolkit against a fully patched ScreenConnect client and confirmed the patch works, meaning those exploited were likely unpatched systems. However, they noted that the toolkit can also hijack authenticated operator sessions and use legitimate ScreenConnect features to push malicious code.
ConnectWise has faced repeated attacks from nation-states and cybercriminals in recent years. Last month, Microsoft warned that a Chinese government-aligned hacking group used automated tools for a supply chain attack on ConnectWise. Chinese groups have targeted ScreenConnect since 2024 due to its widespread use across U.S. businesses and government agencies.
Related
