GoKawiilScreenConnect attack campaign hits six MSPs, 286 endpoints across 47 firms
Cybersecurity firm Huntress identified an active malware campaign exploiting compromised ScreenConnect cloud instances to push rogue remote-access clients onto customer devices. As of its initial report, six MSPs and 286 endpoints across 47 organizations were affected, with numbers still rising. ConnectWise confirmed it is investigating the activity alongside Huntress.
GoKawiil's interpretation of the reporting above, not reported fact.
Because MSPs manage remote access for many downstream clients, a single compromised ScreenConnect instance could let attackers pivot into numerous unrelated businesses at once. Huntress also flagged a possible reverse-pivot technique that could infect a technician's own workstation during a support session, which—if confirmed—would mean the usual direction of trust in remote support tools could be turned against defenders. The exact mechanism, including whether it relies on a software flaw, remains unconfirmed.
- Six MSPs and 286 endpoints across 47 organizations were affected as of the report, with the count still climbing.
- Attackers reportedly used ScreenConnect's Run Command feature to install unauthorized remote-access clients on managed devices.
- ConnectWise is investigating and has advised partners to avoid interactive ScreenConnect sessions with suspected compromised devices.
Source: bleepingcomputer.com, 2026-11-11
Published there as: “Active ScreenConnect attacks breach MSPs, impact dozens of organizations”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.