As reported by BleepingComputer, an active campaign targeting ConnectWise ScreenConnect environments has compromised at least six MSPs and 286 endpoints across 47 organizations, with numbers climbing. Attackers are abusing ScreenConnect's Run Command functionality to deploy rogue remote-access clients on managed devices, and Huntress has identified a potential reverse-pivot technique that could compromise technician workstations during support sessions.

Threat Alert: As reported by BleepingComputer, an active campaign targeting ConnectWise ScreenConnect environments has compromised at least six MSPs and 286 endpoints across 47 organizations, with numbers climbing.

This incident underscores a structural risk we've flagged repeatedly: remote monitoring and management (RMM) platforms are de facto critical infrastructure for the MSP ecosystem, yet they receive nowhere near the security investment of, say, identity providers or cloud control planes. When an RMM is compromised, the blast radius isn't one company — it's every customer that MSP touches.

What Makes This Campaign Dangerous

Three characteristics elevate this beyond a routine credential-stuffing incident:

What Makes This Campaign Dangerous
Cascading trust exploitation: Attackers aren't just stealing data from one MSP — they're using the MSP's legitimate tooling to silently establish independent access to downstream customer environments. Rogue ScreenConnect clients deployed via Run Command persist beyond the initial compromise.
Reverse-pivot risk: The reported technique where technician workstations may be compromised when connecting to infected customer devices is particularly alarming. This inverts the typical attack model — defenders connecting to investigate could themselves become victims, creating a lateral-movement chain across the MSP's internal network.
Sequential targeting indicators: Huntress noted that attacker-assigned sequential tags suggest earlier, undetected compromises. Organizations that haven't checked their Run Command history may already be compromised without knowing it.

Who Is Most at Risk

Cloud-hosted ScreenConnect instances are the primary attack surface, but on-premises deployments with exposed web interfaces face similar risk if credentials are compromised. MSPs are the primary targets, but the downstream impact falls on their customers — small and midsize businesses that lack visibility into their MSP's security posture and may have no independent detection capability.

MSPs supporting healthcare, local government, and critical infrastructure customers face amplified regulatory and operational consequences from this type of supply-chain compromise.

Broader Implications

The MSP supply chain has become one of the most attractive attack surfaces in cybersecurity. Threat actors understand that compromising a single MSP can yield access to dozens or hundreds of endpoints across multiple organizations — all through legitimate, trusted tooling that most defenders won't initially flag as malicious.

This campaign mirrors patterns seen in the 2023 MOVEit and Kaseya attacks: trusted infrastructure weaponized for mass distribution. The difference here is the reverse-pivot capability, which effectively turns incident response into an attack vector. That should concern every organization that relies on interactive remote support.

Shield53 Recommendations

Immediate Actions (0–24 hours)

  • Halt interactive sessions: Follow ConnectWise guidance — do not open interactive ScreenConnect sessions to suspected compromised devices. Use isolated investigation environments or separate tooling.
  • Audit Run Command history: Export and review all Run Command activity for the past 30+ days. Look for unexpected command execution, PowerShell downloads, or MSI/EXE deployments outside normal change windows.
  • Revoke and reset: From a trusted device, revoke all active ScreenConnect sessions, reset all technician credentials, and enforce MFA re-enrollment. Audit for newly created or modified accounts.
  • Inventory deployed agents: Compare ScreenConnect client installations across all managed endpoints against your known-good inventory. Rogue clients may use non-standard installation paths or naming conventions.

Hardening (1–2 weeks)

  • Restrict Run Command: Limit Run Command to a small set of named administrators with break-glass procedures. Most day-to-day support does not require arbitrary command execution.
  • Implement session recording: Enable and retain ScreenConnect session recordings and command logs. Forward to SIEM for correlation with other telemetry.
  • Network segmentation: Isolate technician workstations from production networks. If reverse-pivot exploitation occurs, segmentation limits lateral movement into MSP core infrastructure.
  • Customer notification protocols: Establish clear communication channels with customers BEFORE an incident. MSPs that proactively disclose and respond will preserve significantly more trust than those that delay.

Strategic (ongoing)

  • Treat RMM platforms with the same security rigor as domain controllers and identity providers — they hold equivalent trust and access scope.
  • Invest in independent monitoring of MSP tooling rather than relying solely on the vendor's own logging and alerting capabilities.
  • Develop and test incident response playbooks specifically for supply-chain compromises, including scenarios where your own tooling is the attack vector.