{"id":"CMP-202611-s74c66","kind":"campaign","aliases":[],"related":[],"title":"Attackers use hijacked cloud-hosted ScreenConnect accounts at MSPs to push rogue ScreenConnect clients to customer devices; 6 MSPs, 286+ endpoints at 47 organizations (Huntress, ConnectWise investigating)","description":null,"summary":"Since about 17:47 UTC on 11 Nov 2026, Huntress's SOC has been tracking an active campaign against cloud-hosted ConnectWise ScreenConnect instances run by managed service providers. Attackers use ScreenConnect's Run Command feature to install their own ScreenConnect clients on the MSP's managed endpoints, which gives them remote access outside the MSP's own ScreenConnect. Confirmed so far: 6 MSPs, 286+ endpoints at 47 organizations, and the count is rising. How they get in is unknown; Huntress's telemetry points to stolen credentials and hijacked MSP support sessions. Huntress also warns of a reverse pivot: a technician's workstation can be compromised when they open a ScreenConnect session to an infected customer device (it is unclear whether this is a bug or abuse of a feature). Sequential tags assigned by the attackers suggest other MSPs were compromised earlier. ConnectWise confirms it is investigating. BleepingComputer found one of the rogue client IDs in a Social Security-themed batch script uploaded to VirusTotal on 25 Jul 2026; it is unclear whether that is the same campaign.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-11T23:25:36+00:00","products":[{"name":"ScreenConnect","fixed":[],"vendor":"ConnectWise","affected":"cloud-hosted instances (method of access unknown)"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"MSPs and IT teams on ScreenConnect (cloud-hosted especially): check the Run Command history and audit log for commands you did not run that install ScreenConnect clients, even if you have had no alerts. On endpoints, look for ScreenConnect client services/folders (C:\\Program Files (x86)\\ScreenConnect Client (<id>)) with an ID that is not your instance's, in particular rogue client ID ed630cc2c873b091. Network: digitaldownloads[.]com (Huntress lists it as a potential IOC) and amexsafekeyupdate[.]com (in the July batch script). Huntress has shared more client IDs and infrastructure; that list was not in the source we read (unknown here).","fix":"Do not open interactive ScreenConnect sessions to devices that may be compromised; investigate them with separate security tools (ConnectWise guidance). Review ScreenConnect account activity, revoke active sessions, reset ScreenConnect credentials from a trusted device, and check that MFA is enforced on every account. Remove rogue ScreenConnect clients and block the IOC domains. Follow the ConnectWise Trust Center for updates. Customers of MSPs: ask your MSP whether it is affected and check for unknown ScreenConnect clients.","status":"open","published_at":null,"first_seen_at":"2026-11-11T23:25:36+00:00","triaged_at":"2026-11-11T23:25:36+00:00","updated_at":"2026-11-11T23:26:20+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-11T23:29:37Z","path":"stolen-credential","entry":"unknown","reason":"The record states 'How they get in is unknown' and says Huntress's telemetry only 'points to' stolen credentials and hijacked MSP support sessions, while the attackers use those hijacked MSP accounts to install rogue ScreenConnect clients on customer devices.","confidence":0.7}},"analyst_status":"done","analyst_note":null,"search":"'-202611':30A '11':43B '17':39B '2026':45B,207B '25':205B '286':21A,102B '47':24A,40B,105B '6':19A,100B 'abus':164B 'access':90B 'account':8A 'activ':53B 'also':131B 'assign':170B 'attack':1A,67B,173B 'batch':199B 'bleepingcomput':185B 'bug':162B 'campaign':33B,54B,216B 'client':15A,79B,191B 'cloud':5A,57B 'cloud-host':4A,56B 'cmp':29A 'command':72B 'compromis':143B,178B 'confirm':97B,181B 'connectwis':27A,59B,180B 'count':109B 'credenti':124B 'custom':17A,153B 'devic':18A,154B 'earli':35B 'earlier':179B 'early-warn':34B 'endpoint':22A,85B,103B 'far':99B 'featur':73B,167B 'found':186B 'get':114B 'give':87B 'hijack':3A,126B 'host':6A,58B 'huntress':26A,46B,118B,130B 'id':192B 'infect':152B 'instal':75B 'instanc':61B 'investig':28A,184B 'jul':206B 'manag':64B,84B 'msp':82B,93B,127B 'msps':10A,20A,101B,176B 'nov':44B 'one':187B 'open':146B 'organ':25A,106B 'outsid':91B 'pivot':136B 'point':121B 'provid':66B 'push':12A 'remot':89B 'revers':135B 'rise':111B 'rogu':13A,190B 'run':62B,71B 's74c66':31A 'screenconnect':7A,14A,32A,60B,69B,78B,96B,148B 'script':200B 'secur':197B 'security-them':196B 'sequenti':168B 'servic':65B 'session':129B,149B 'sinc':37B 'soc':48B 'social':195B 'stolen':123B 'suggest':174B 'support':128B 'tag':169B 'technician':138B 'telemetri':120B 'theme':198B 'track':51B 'unclear':157B,210B 'unknown':117B 'upload':201B 'use':2A,68B 'utc':41B 'virustot':203B 'warn':36B,132B 'whether':158B,211B 'workstat':140B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["screenconnect"],"ptokens":["screenconnect"],"labels":["campaign","critical","earlywarning","vendor"],"campaign_type":"supply-chain","search_a":"'-202611':30A '286':21A '47':24A '6':19A 'account':8A 'attack':1A 'client':15A 'cloud':5A 'cloud-host':4A 'cmp':29A 'connectwis':27A 'custom':17A 'devic':18A 'endpoint':22A 'hijack':3A 'host':6A 'huntress':26A 'investig':28A 'msps':10A,20A 'organ':25A 'push':12A 'rogu':13A 's74c66':31A 'screenconnect':7A,14A,32A 'use':2A","search_b":"'11':43B '17':39B '2026':45B,207B '25':205B '286':102B '47':40B,105B '6':100B 'abus':164B 'access':90B 'activ':53B 'also':131B 'assign':170B 'attack':67B,173B 'batch':199B 'bleepingcomput':185B 'bug':162B 'campaign':33B,54B,216B 'client':79B,191B 'cloud':57B 'cloud-host':56B 'command':72B 'compromis':143B,178B 'confirm':97B,181B 'connectwis':59B,180B 'count':109B 'credenti':124B 'custom':153B 'devic':154B 'earli':35B 'earlier':179B 'early-warn':34B 'endpoint':85B,103B 'far':99B 'featur':73B,167B 'found':186B 'get':114B 'give':87B 'hijack':126B 'host':58B 'huntress':46B,118B,130B 'id':192B 'infect':152B 'instal':75B 'instanc':61B 'investig':184B 'jul':206B 'manag':64B,84B 'msp':82B,93B,127B 'msps':101B,176B 'nov':44B 'one':187B 'open':146B 'organ':106B 'outsid':91B 'pivot':136B 'point':121B 'provid':66B 'remot':89B 'revers':135B 'rise':111B 'rogu':190B 'run':62B,71B 'screenconnect':60B,69B,78B,96B,148B 'script':200B 'secur':197B 'security-them':196B 'sequenti':168B 'servic':65B 'session':129B,149B 'sinc':37B 'soc':48B 'social':195B 'stolen':123B 'suggest':174B 'support':128B 'tag':169B 'technician':138B 'telemetri':120B 'theme':198B 'track':51B 'unclear':157B,210B 'unknown':117B 'upload':201B 'use':68B 'utc':41B 'virustot':203B 'warn':36B,132B 'whether':158B,211B 'workstat':140B","search_c":"","cause_entry":"unknown","cause_path":"stolen-credential","disclosures_checked_at":"2026-11-11T23:27:42+00:00","first_public_at":"2026-11-11T22:56:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-s74c66","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T23:25:36+00:00","fetched_at":"2026-11-11T23:25:36+00:00","note":null}],"documents":[{"id":129898,"url":"https://x.com/BleepinComputer/status/2120652762501275700","title":"@BleepinComputer: 🚨 Hackers are breaching MSPs through compromised ScreenConnect panels, deploying","kind":"post","source":"x","publisher":null,"text":"🚨 Hackers are breaching MSPs through compromised ScreenConnect panels, deploying rogue remote access tools to customer devices.\n\n@HuntressLabs  reports 6 compromised MSPs and 286 affected endpoints across 47 organizations, with the numbers rising.\n\nAttackers can also reportedly\n\nlikes 7 reposts 1","published_at":"2026-11-11T22:59:53+00:00","relation":"describes","confidence":null,"note":null},{"id":129775,"url":"https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/","title":"BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations","kind":"blog","source":"blog","publisher":null,"text":"Active ScreenConnect attacks breach MSPs, impact dozens of organizations\n\nConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]","published_at":"2026-11-11T22:56:21+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}