Lawrence Abrams reports: ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, warning that they may be associated with...
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
About this summary. This is a short excerpt from the description that DataBreaches.net published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://databreaches.net/2026/11/12/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/
Source attribution: headline and facts are from DataBreaches.net (databreaches.net). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue…
CastleRAT - 179,745 breached accounts
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote…
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected…
ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
Abuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise. Cybersecurity researchers had spotted…
🏴☠️ Interlock has just published a new victim : K&A Industries
K&A Industries is a "secure identity architecture" company that manages the entire authentication lifecycle for government and enterprise clients. As a result, their own…
SCKit abuses ScreenConnect to deploy remote access and target technician sessions
ScreenConnect architecture and attack surfaces Attack chain overview Mitigation and protection guidance Indicators of compromise and supporting artifacts References…