A newly reported cyberattack campaign involving ConnectWise ScreenConnect highlights the risks associated with remote management tools used by managed service providers (MSPs). Huntress researchers observed attackers using ScreenConnect management panels to attempt installation of rogue clients on at least 288 endpoints across 48 organizations.
Attackers reportedly abused management access to distribute malicious software and establish persistent remote access. ConnectWise has stated that it has not identified a ScreenConnect vulnerability or evidence of compromised infrastructure.
For MSPs managing multiple client environments, the incident highlights four remote access risks that deserve attention.
1. Unauthorized Access to Remote Management Tools
Researchers observed attackers using ScreenConnect’s Run Command functionality to deploy unauthorized clients onto managed endpoints. The initial access method remains under investigation, with compromised credentials or hijacked administrator sessions among the possibilities. Because MSP technicians manage multiple customer environments, unauthorized console access could expose additional systems.
MSP Takeaway: Enforce multifactor authentication, restrict administrative privileges, review technician accounts, and investigate unusual sign-ins and ScreenConnect Run Command history, even when no security alerts have appeared.
2. Third-Party Extensions and Integration Risks
ConnectWise took precautionary action involving five third-party extensions after reports of unauthorized access. Approximately 400 partner environments had at least one identified extension installed. The company indicated that third-party extensions may have played a role, although the initial access method remains unconfirmed. Having an affected extension installed does not establish that an environment was compromised.
For MSPs, the incident reinforces the importance of evaluating integrations within trusted management platforms.
MSP Takeaway: Review installed extensions, follow ConnectWise’s latest guidance, remove unnecessary integrations, and regularly assess third-party permissions.
3. Rogue Remote Access Software and Persistent Threats
Attackers reportedly deployed unauthorized ScreenConnect clients designed to maintain access independently of the original management environment. Researchers also identified a malicious toolkit called SCKit, with capabilities involving persistence, interference with security controls, and installation of additional software.
Because legitimate remote access tools are common in MSP-managed environments, unauthorized installations can be difficult to distinguish from routine activity.
MSP Takeaway: Maintain inventories of approved remote access tools, monitor unexpected installations, and investigate unfamiliar management clients across customer endpoints.
4. Technician Workstations and Cross-Client Exposure
Malware analysis revealed capabilities designed to move from compromised endpoints toward technician workstations, capture browser sessions and authentication tokens, and potentially access additional ScreenConnect environments. However, researchers had not observed successful execution of this lateral-movement sequence. The capability represents a potential risk rather than confirmed spread across client environments.
Technician workstations are especially sensitive because they often provide privileged access to multiple clients.
MSP Takeaway: Harden technician workstations, protect privileged sessions, monitor suspicious authentication activity, and maintain response procedures for potential cross-client exposure.
What This Means for MSPs
The ScreenConnect attacks demonstrate how cybercriminals can abuse trusted remote management capabilities without necessarily exploiting a software vulnerability.
For MSPs, the priorities are securing management access, reviewing third-party integrations, detecting unauthorized remote access tools, and protecting technician workstations. Strengthening these controls helps MSPs reduce exposure, improve incident readiness, and protect the client environments that depend on their services.