ConnectWise Disables Third-Party Extensions After Rogue ScreenConnect Clients Hit 288 Endpoints

What Happened

ConnectWise has disabled five third-party extensions in partner environments after reports of unauthorized access involving ScreenConnect, its remote access tool. According to The Hacker News, the activity has affected at least 288 endpoints across 48 organizations, with rogue ScreenConnect clients deployed as part of the attack. ConnectWise says it has found no evidence that its own infrastructure was compromised or that a vulnerability exists in the ScreenConnect software itself. The company's initial assessment is still under way, and the precise source of the unauthorized access has not been confirmed.

Why It Matters

ScreenConnect is widely used by managed service providers (MSPs) and IT teams. That makes it an attractive pivot point for attackers, because a trusted integration can provide access into many downstream customer environments at once. The reported activity spans 48 separate organizations. Organizations that rely on MSPs using ScreenConnect should treat this as a potential upstream risk, even if they do not manage ScreenConnect directly.

What Defenders Should Watch For

• Inventory any ScreenConnect instances and third-party extensions in use, and check whether any of the five extensions ConnectWise disabled are present in your environment or your MSP's.
• Review ScreenConnect client installations for unexpected or unauthorized instances, including new client GUIDs, install sources, or connections that do not match known IT workflows.
• Hunt for unusual outbound connections from endpoints to unfamiliar ScreenConnect relay or instance URLs, and audit recent remote-access sessions for anomalous timing, source IPs, or accounts.
• Coordinate with any MSP or third party that manages ScreenConnect on your behalf to confirm whether your environment was in scope and what remediation steps they have taken.
• Monitor ConnectWise's advisory for updates, since the root cause and the full list of affected extensions may change as the investigation continues.

Developing Story

This is based on an initial advisory and ConnectWise's preliminary assessment, which may be revised as more details emerge. No CVE has been assigned, and the precise mechanism of the unauthorized access has not been confirmed. For the latest details, see the original report at The Hacker News.