ScreenConnect attacks affect 47 organizations, Huntress says

Attackers are abusing ScreenConnect, a remote support tool used by managed service providers and IT teams, to reach customer devices.

Huntress says it has found six compromised providers and 286 affected endpoints across 47 organizations, and the numbers are rising.

The attackers used the tool’s Run Command feature to install rogue ScreenConnect clients, giving them remote access outside the providers’ legitimate systems.

Huntress also warned that a session with an infected device could put a provider technician’s workstation at risk, but the method is not clear.

How the attackers first got into provider systems remains unknown; Huntress says evidence points to stolen credentials and hijacked support sessions.

ConnectWise is investigating and advises partners to avoid interactive sessions with suspected infected devices, review account activity, end active sessions, reset credentials from a trusted device and check multifactor authentication.

Providers are urged to check Run Command history, including if they have not received an alert, while ConnectWise says it will share further guidance through its Trust Center.