Sophos

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has disabled five third-party extensions after reports of unauthorized access to partner environments. The company found no evidence of compromise to its own infrastructure or vulnerabilities in ScreenConnect software. Huntress observed attackers using compromised panels to deploy rogue clients, infecting 288 endpoints across 48 organizations. The attack spreads in a worm-like manner from endpoints to technician workstations and then to additional panels. SCKit toolkit establishes persistence, steals session cookies, and relays commands through the Shared Toolbox feature. Sophos confirmed similar activity originating from three specific ScreenConnect instance IDs. Partners are advised to review Run Command history and monitor for unusual logins and extension activity.