ScreenConnect campaign hits 6 MSPs and 286 affected endpoints

By Rebecca Stone

Huntress has identified six compromised managed service providers (MSPs) and 286 affected endpoints (managed customer devices) across 47 organizations in an active ScreenConnect malware campaign. ConnectWise is investigating reports that attackers used compromised cloud-hosted ScreenConnect instances to deploy rogue remote-access clients on customer devices.

What did ConnectWise confirm?

ConnectWise told BleepingComputer: “We are aware of reports of malicious activity affecting a limited number of ScreenConnect partners and are actively investigating.” The vendor issued six precautions for partners:

• Avoid opening interactive ScreenConnect sessions to suspected compromised devices.
• Use separate security tooling to investigate suspected systems.
• Review account activity.
• Revoke active sessions.
• Reset credentials from a trusted device.
• Verify multifactor authentication.

ConnectWise said it would provide further information and guidance through the ConnectWise Trust Center.

How did the ScreenConnect campaign work?

Huntress discovered the campaign on Wednesday. Its security operations center (SOC) posted on Reddit: “Our SOC is working an active campaign that started around 17:47 UTC today targeting cloud-hosted ScreenConnect instances. We are currently tracking 6 compromised MSPs and 286+ endpoints, and those numbers are climbing. ConnectWise is engaged and working this with us.”

ScreenConnect is a remote-access and support platform used by MSPs and IT teams to manage and troubleshoot customer devices. According to Huntress, attackers are using the Run Command function to deploy ScreenConnect clients on managed endpoints, providing remote access outside the legitimate MSP’s ScreenConnect environment.

How could attackers pivot to technician workstations?

Huntress has not determined how the attackers gained access to affected MSP environments, but current telemetry points to compromised credentials and hijacked MSP support sessions. The researchers also warned of a potentially more dangerous reverse-pivot technique, meaning attackers could compromise an MSP technician’s workstation during a session with an infected customer device.

The mechanics remain unclear. Researchers do not know whether the technique exploits a software vulnerability or abuses legitimate ScreenConnect functionality. Sequential attacker-assigned tags suggest that additional MSPs may have been compromised earlier. Huntress therefore advised all ScreenConnect users to inspect Run Command history, even without receiving alerts.

Which compromise indicators should MSPs inspect?

Huntress shared indicators of compromise (IOCs), or artifacts that can reveal attacker activity. The list includes:

• Attacker relay: 185.99.255[.]28, with hostname screen.
• Command-and-control (C2) domains: newnewnew.gotdns[.]org and soxnewwork.homedns[.]org.
• Possible additional C2: cdn007-digitaldownloads[.]com.
• Secondary C2: sc.payproofkit[.]com, linked to 155.94.150[.]39 with hostname WIN-FB5CKHMU4E1.
• Stager, a component that retrieves malware: hxxps://ns.mo7sen[.]dev/EadF.php?p=4.
• Rogue ScreenConnect client IDs: 2588ef5c15954b10 and ed630cc2c873b091.
• Installer pattern: /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N>.
• Attacker name: Addmin.
• Files: Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe and Run-Lateral-Full.bat.

Huntress provided the indicators to help organizations identify malicious activity across ScreenConnect records, network infrastructure and managed endpoints.

What earlier malware activity surfaced?

BleepingComputer found an earlier malicious batch script that references ed630cc2c873b091, one of the rogue ScreenConnect client IDs. The discovery suggests that the identifier was used in malicious activity months before the current attacks were disclosed.

The file, named SSA-2026-STATEMENT-15518787.bat, was first uploaded to VirusTotal on July 25, 2026. Its Social Security Administration-themed filename appears to impersonate an official statement, suggesting that the script may have been distributed through phishing.

The batch file attempts to add Microsoft Defender exclusions (rules that bypass scanning for specified paths). It creates persistence through the Windows Startup folder and the Run registry key. The script then contacts amexsafekeyupdate.com to retrieve installation commands for two separate installers.

VirusTotal sandbox activity associated with the sample showed downloads of ScreenConnect MSI (Windows installer) packages from cdn007-digitaldownloads[.]com and cyberrexdesign.screenconnect[.]com. Huntress listed cdn007-digitaldownloads[.]com as a possible additional C2.

After launching the second installer, the script uses PowerShell to search running processes and Windows services for ed630cc2c873b091. A match causes the script to treat the installation as successful and notify the attackers through Telegram.

Researchers said the July file appears designed for a different distribution campaign. It remains unclear whether that activity and the current attacks against MSPs belong to the same campaign.

What should partners review now?

Huntress urged MSPs to review their environments for signs of compromise and avoid initiating interactive ScreenConnect sessions with potentially infected endpoints. ConnectWise advised partners to use separate investigation tools, revoke active sessions, reset credentials and confirm multifactor authentication. BleepingComputer said it had sent Huntress additional questions and would update the report if the security firm responded.