ScreenConnect attacks breach MSPs, deploy rogue access clients

ConnectWise is investigating active malware attacks against managed service providers exploiting compromised ScreenConnect environments. Attackers deploy rogue remote-access clients to customer devices, potentially affecting dozens of organizations. The campaign specifically targets MSPs, leveraging their trusted access to customer networks. Organizations should review ScreenConnect logs for unauthorized access and verify the legitimacy of remote-access clients on systems.