ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations

IT management software company ConnectWise said it is investigating reports of unauthorized access to its customers following reports from multiple cybersecurity firms that almost 50 organizations had been breached through the company’s ScreenConnect tool. 

Late on Wednesday evening, ConnectWise said it believes the activity is related to the abuse of an independent third-party extension installed in customer environments. The tool, RMM+, is an extension for ConnectWise ScreenConnect that allows external management tools to automate and control remote sessions through an API. 

“We identified approximately 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed. Their presence alone does not establish compromise,” the company said.  

“These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup.”

The Tampa-based company told customers that threat actors were deploying additional remote-access software and also saw “potential compromise of technician workstations during interactive connections to affected devices. “

The company disabled RMM+ in the 400 customer environments and urged customers with on-premises systems to disable it themselves because ConnectWise cannot do it for them. All customers should verify that RMM+ is disabled. 

Customers should also be wary of any ScreenConnect connections to suspected compromised devices, ConnectWise added. 

“Disabling extensions and resetting credentials alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints,” the company said, warning of unusual sign-ins and repeated login failures. 

ConnectWise initially said it identified five different third-party extensions that may be associated with the malicious activity but later traced it back to RMM+.

Compromised credentials?

The advisories that prompted ConnectWise to act came after cybersecurity firm Huntress said it saw 288 affected endpoints across 48 organizations targeted within 90 minutes. Huntress incident responders found commands tied to RMM+ across several ScreenConnect systems and confirmed that ConnectWise disabled RMM+ alongside four other third-party extensions. 

“Huntress hasn’t seen evidence of a new vulnerability, but it’s still unclear how the attacker got panel access. Current telemetry points to compromised credentials or hijacked operator sessions to gain initial access, but Huntress’ researchers will update when they know more,” a Huntress spokesperson said. 

In several attacks, the threat actors used compromised systems to create persistent backdoors and used infected endpoints to spread malware throughout a network when a technician connected to that compromised endpoint. 

ScreenConnect is used widely by managed service providers that run company IT infrastructure and end-user systems. 

Huntress and several other researchers said the attack campaign may be tied to a ConnectWise vulnerability discovered in September — CVE-2026-84869. The Cybersecurity and Infrastructure Security Agency warned that it was being exploited in September.

Blackpoint Cyber researchers Sam Decker and Nevan Beal told Recorded Future News that they were able to reverse engineer the toolkit the attackers used in the recent ScreenConnect attacks and said it involves the exploitation of CVE-2026-84869. 

Both researchers noted that they tested the toolkit against a fully patched ScreenConnect client and confirmed the patch works — meaning those exploited were likely unpatched. 

“Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it,” Decker and Beal added. 

“But the toolkit also includes capabilities to hijack authenticated operator sessions and use legitimate ScreenConnect management features to push malicious code. Patching addresses the known exploit, but it doesn't eliminate the risks associated with a compromised operator session. Organizations need to protect those sessions and put additional safeguards around high-impact administrative actions.”

ConnectWise has repeatedly faced attacks from both nation-states and cybercriminals in recent years. Last month, Microsoft warned that a Chinese government-aligned hacking group used automated tools to carry out a supply chain attack on ConnectWise. 

Chinese government groups have repeatedly targeted ScreenConnect since 2024 because of its widespread use across U.S. businesses and government agencies.