Hackers Hijack ScreenConnect, Seize Remote Access and Deploy Malware

Threat actors are reportedly engaged in an ongoing attack campaign, hijacking instances of ConnectWise ScreenConnect to gain unauthorised remote access and deploy malicious software.

The campaign allows attackers to seize control of vulnerable ScreenConnect installations, a widely used remote monitoring and management (RMM) solution, potentially compromising numerous organisations that rely on the software for IT support and system administration.

The installation of “rogue software” suggests that threat actors are leveraging the initial access to establish persistence, exfiltrate data, or launch further attacks within victim networks.

Organisations using ConnectWise ScreenConnect are advised to immediately review the security of their installations. This includes ensuring all instances are fully patched, enforcing strong multi-factor authentication (MFA) for all accounts, and monitoring for any unusual activity or unauthorised access attempts.

The compromise of remote access tools like ScreenConnect presents a severe risk, as they offer deep access into IT environments, making them attractive targets for cybercriminals seeking to establish a foothold for broader network compromise, data theft, or ransomware deployment.