An active malware campaign is targeting IT companies that use ConnectWise ScreenConnect for remote support. As of November 12, attackers have compromised at least 6 managed service providers and deployed unauthorized remote-access software on 286+ business endpoints across 47 organizations — and those numbers are still climbing.
What's Happening
ScreenConnect is a remote support tool that managed IT providers use to connect to your computer and fix problems. Think of it as the door your IT company uses to get in when you need help. That door is currently being targeted by attackers.
Cybersecurity firm Huntress detected the campaign Wednesday afternoon and published details as it unfolded. The attack isn't a traditional software vulnerability — there's no "bug" that Microsoft or ConnectWise forgot to patch. Instead, attackers appear to have obtained legitimate credentials or hijacked active sessions for MSP ScreenConnect accounts. Once inside, they used ScreenConnect's own built-in Run Command feature to silently install rogue remote-access clients onto the business computers those MSPs manage.
In plain terms: attackers got into the IT company's toolbox, then used that access to put a backdoor on the IT company's clients' computers.
How Bad Is It?
Huntress is tracking 6 confirmed compromised MSPs and counting, with 286+ endpoints affected across 47 organizations. The number of victims was still rising as of late Wednesday.
ConnectWise confirmed the incident and took immediate action, disabling five third-party ScreenConnect extensions across approximately 400 partner environments. The extensions flagged are:
- Labtech Plus
- RMM Plus
- RMM+
- RMM Plus Password Link
- RMM+ Password Link
ConnectWise believes attackers used these extensions as part of the attack chain. Importantly: partners who never installed any of these five extensions have no reason to believe they're affected, according to ConnectWise. That said, the company encouraged all partners to stay on heightened alert.
There's also a particularly nasty wrinkle: Huntress warned that if a technician opens an interactive ScreenConnect session with an already-infected computer, the attacker may be able to pivot to the technician's workstation. ConnectWise has received reports confirming this, though they're still investigating the mechanism.
What to Watch For
If you're a business that uses an IT company for managed services, here are signs something might be wrong:
- Unexpected remote-access software appearing on your computer — ScreenConnect or similar tools you didn't install and don't recognize
- Unusual activity logged in your security software — connections to unfamiliar IP addresses or domains
- Your IT company reaching out about a "security incident" — that's them doing the right thing by telling you
Huntress published the following known attacker infrastructure for anyone who wants to run checks:
Attacker relay: 185.99.255[.]28 · C2 domains: newnewnew.gotdns[.]org, soxnewwork.homedns[.]org · Secondary C2: sc.payproofkit[.]com
Sources: BleepingComputer · ConnectWise Security Advisory
Also This Week
Windows 11 November Update Is Failing to Install on Some PCs
Separately, Microsoft confirmed this morning that the November 2026 security update — KB5132061 — is failing to install on some Windows 11 devices. Affected machines are stuck in a retry loop and showing error codes 0x80070306, 0x800f0989, or 0x800f0993.
The issue affects only devices that installed the October 2026 non-security preview update (KB5127936). If you skipped the optional October preview, you're not affected.
The good news: Microsoft says this will fix itself automatically by Friday morning. No action needed. If a machine is still showing errors after 48 hours from November 11, Microsoft Support is the next call.
Source: BleepingComputer