BleepingComputer reported on 11 November 2026 (06:56 AWST 12 Nov) that ConnectWise is investigating an active campaign against managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.

According to BleepingComputer, security firm Huntress said the activity began at about 17:47 UTC on 11 November (01:47 AWST 12 Nov) against cloud-hosted ScreenConnect instances, and that it was tracking six compromised MSPs and 286 affected endpoints across 47 organisations, with numbers rising.

Huntress said the attackers use ScreenConnect's Run Command feature to install ScreenConnect clients on managed endpoints that connect outside the MSP's own ScreenConnect environment, and warned of a technique that may compromise a technician's workstation when the technician opens a session to an infected device; BleepingComputer says it is unclear whether that technique uses a software vulnerability.

Huntress has not determined how the attackers get in; it said its telemetry points to compromised credentials and hijacked MSP support sessions, and that sequential attacker-assigned tags suggest other MSPs may have been compromised earlier. (source: BleepingComputer, quoting Huntress)

ConnectWise told BleepingComputer it is aware of malicious activity affecting a limited number of ScreenConnect partners and is investigating. It advised partners not to open interactive ScreenConnect sessions to suspected compromised devices, to investigate with separate security tooling, to review account activity, revoke active sessions, reset credentials from a trusted device and verify multi-factor authentication, and said it will publish further guidance through the ConnectWise Trust Center. (source: ConnectWise statement to BleepingComputer)

Indicators Huntress shared, per BleepingComputer: attacker relay 185.99.255[.]28; C2 domains newnewnew.gotdns[.]org and soxnewwork.homedns[.]org; secondary C2 sc.payproofkit[.]com (155.94.150[.]39); rogue ScreenConnect client IDs 2588ef5c15954b10 and ed630cc2c873b091; installer URLs containing c=Exploited<N>; attacker name 'Addmin'; files Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe and Run-Lateral-Full.bat.