Attackers abuse ScreenConnect remote access tool to reach MSP customers

Security firm Huntress has uncovered an active campaign in which attackers are using compromised ScreenConnect accounts to reach the computers of businesses served by managed service providers (MSPs), the outside IT companies that look after other organizations' technology. ScreenConnect is remote access software that lets IT technicians connect to and fix computers from a distance.

Huntress reported six compromised MSPs and more than 286 affected computers across 47 organizations, and said those numbers were still climbing. The attackers used a ScreenConnect feature called Run Command to install their own copies of ScreenConnect on client machines, giving them a separate way in that the legitimate IT provider does not control. Researchers also warned that a technician's own computer could be compromised when connecting to an infected client device.

ConnectWise, the company behind ScreenConnect, confirmed unauthorized access to partner accounts. It suspects five third-party add-ons, called extensions, played a role, and disabled them as a precaution across roughly 400 cloud-hosted partner environments. Providers who run ScreenConnect on their own servers must turn those extensions off themselves. ConnectWise stressed that disabling the extensions does not remove any access attackers may have already set up.

According to Huntress, this appears to be abuse of normal features rather than a software flaw, and early evidence points to stolen passwords or hijacked login sessions. Huntress also noted that clues in the attack suggest other MSPs may have been hit earlier, and it has seen a significant increase this year in attacks that use legitimate remote management software.

For a small business, the lesson is that the tools your IT provider uses to help you can also become a path in if their accounts are compromised. It is reasonable to ask your provider how they protect those tools and whether they have checked for this activity.