CONNECT WITH US
Cyber Security

Cyber Security

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

The Hacker News logo

Published on

Add as a preferred source on Google
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access.

In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software.

"Our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," it said. "We are continuing to validate this assessment. The initial access method and full scope remain under investigation."

ConnectWise has identified about 400 partner environments with at least one of the third-party extensions installed. It also emphasized that the presence of the extensions alone does not indicate or establish compromise.

While these extensions provide an API capable of executing remote commands, access to that API is secured by a passphrase configured by the partner during setup, it added. The list of extensions identified for precautionary disabling is below -

ConnectWise also said it has urged on-premises partners to disable the extensions, and is recommending all partners to ensure security controls are running, preserve suspicious activity logs, and stay vigilant for -

Cybersecurity company Huntress, which is also tracking the activity, said it has observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands with an aim to install rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The activity was first detected on November 11, 2026, at around 5:47 p.m. UTC.

Huntress told The Hacker News that it has not seen evidence of a new vulnerability, but noted the exact method through which the attacker got panel access remains unclear.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.