If you run ScreenConnect, or buy IT support from a provider that does, check your Run Command history and installed extensions today. An active campaign is turning compromised MSP consoles into delivery systems for rogue remote-access clients, and the attackers may already have a foothold that no vendor action will remove.

What happened

According to BleepingComputer, Huntress spotted the campaign on Wednesday, targeting cloud-hosted ScreenConnect instances. Huntress counted six compromised MSPs and 286 affected endpoints across 47 organizations, with the numbers still rising. The attackers use the Run Command feature to install their own ScreenConnect clients on managed devices, which gives them remote access outside the MSP’s own environment.

ConnectWise confirmed unauthorized access to partner accounts and unauthorized remote-access software in customer environments. It suspects the attackers used five independent third-party extensions, and it disabled them across roughly 400 partner environments as a precaution. On-premises customers must disable them manually. ConnectWise stressed that disabling does not remove software or persistence already on endpoints.

Huntress’s Spike Brandt described the activity as abuse of legitimate functionality, with custom tooling sometimes compiled on the victim’s machine. How the attackers first got into MSP environments is unknown, though Huntress telemetry points to stolen credentials or hijacked operator sessions. ConnectWise has also received unconfirmed reports of technician workstations being compromised during interactive sessions with infected devices.

Why it matters

The attack needs no vulnerability, so there is no patch to apply. Defenders face a legitimate tool used as designed, which makes the activity look like routine administration. That shifts the burden from patching to identity controls, logging and extension governance.

It also fits a pattern Huntress describes: a significant rise in 2026 in attacks that use legitimate RMM software as an initial payload. BleepingComputer found an older malicious script, uploaded in July, that references one of the same rogue client IDs. The link to the current campaign is unclear, but Huntress says sequential attacker tags suggest other MSPs were compromised earlier. The victim count may therefore grow well beyond today’s figures.

The technician-workstation risk is the sharpest concern. If a support session can pull an attacker back into the MSP, one infected customer device can threaten every other customer that provider manages. We covered a related concentration risk in the N-central shutdown.

What it means for you

If you operate ScreenConnect, start with the records ConnectWise names: authentication logs, extension installation records, administrative activity, Run Command history and Toolbox records. Check them even without alerts. Huntress published indicators, including the rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091, C2 domains and file names such as Panel-Lateral.ps1 and ToolboxRelayUploader.exe. Hunt for them across your endpoints.

On-premises users must disable the five flagged extensions themselves, and everyone should hold off reinstalling them until ConnectWise issues guidance. Review which other third-party extensions you have installed and who can add them. Reset credentials and end active sessions for operators if anything looks off.

Tell technicians not to open interactive sessions with devices that might be compromised. Investigate those machines with separate security tooling instead.

If you buy managed services, ask your provider in writing whether it uses ScreenConnect, whether it has run these checks and whether any of your endpoints show unfamiliar remote clients. Run your own inventory of remote-access software on your devices. Any ScreenConnect client that does not tie back to your provider’s instance deserves scrutiny. Longer term, weigh whether your contract limits a provider’s blast radius, for example through separate credentials per client and session logging you can inspect. More guidance sits on our cybersecurity page.

What to watch

  • Whether Huntress or ConnectWise identify the initial access method, whether stolen credentials or hijacked sessions.
  • Confirmation of how malware moves from an infected endpoint to a technician workstation.
  • Growth in the count of compromised MSPs, especially if earlier compromises surface.
  • ConnectWise guidance on when, or whether, the disabled extensions can return, and any changes to the extensions marketplace.

Sources