IT administration software program agency ConnectWise says a suspected state-sponsored cyberattack breached its surroundings and impacted a restricted variety of ScreenConnect prospects.
“ConnectWise just lately discovered of suspicious exercise inside the environment that we imagine was tied to a classy nation state actor, which affected a really small variety of ScreenConnect prospects,” ConnectWise shared in a temporary advisory.
“We’ve got launched an investigation with one of many main forensic specialists, Mandiant. We’ve got contacted all affected prospects and are coordinating with legislation enforcement.”
ConnectWise is a Florida-based software program firm that gives IT administration, RMM (distant monitoring and administration), cybersecurity, and automation options for managed service suppliers (MSPs) and IT departments.
One in every of its merchandise is ScreenConnect, a distant entry and assist software that permits technicians to securely hook up with shopper techniques for troubleshooting, patching, and system upkeep.
As first reported by CRN, the corporate now says it has carried out enhanced monitoring and hardened the safety throughout its community.
In addition they state that they haven’t seen any additional suspicious exercise in buyer cases.
ConnectWise didn’t reply BleepingComputer’s questions on what number of prospects have been impacted, when the breach occurred, or whether or not any malicious exercise was noticed in prospects’ ScreenConnect cases.
Nevertheless, a supply advised BleepingComputer that the breach occurred in August 2024, with ConnectWise discovering the supicious exercise in Might 2025, and that it solely impacted cloud-based ScreenConnect cases. BleepingComputer has not been in a position to independently verify the breach dates.
Jason Slagle, President of managed service supplier CNWR, advised BleepingComputer that solely a really small variety of prospects have been impacted, suggesting the menace actor carried out a focused assault towards particular organizations.
In a Reddit thread, prospects shared additional particulars, stating the incident is linked to a ScreenConnect vulnerability tracked as CVE-2025-3935, patched on April 24.
The CVE-2025-3935 flaw is a high-severity ViewState code injection bug attributable to unsafe deserialization of ASP.NET ViewState in ScreenConnect variations 25.2.3 and earlier.
Risk actors with privileged system-level entry can steal the key machine keys utilized by a ScreenConnect server and make the most of them to craft malicious payloads that set off distant code execution on the server.
Whereas ConnectWise didn’t state that this vulnerability was exploited on the time, it was marked as “Excessive” precedence, indicating it was both actively exploited or carried a big threat of exploitation.
The corporate additionally acknowledged that the flaw was patched on its cloud-hosted ScreenConnect platforms at “screenconnect.com” and “hostedrmm.com” earlier than it was publicly disclosed to prospects.
Because the breach solely impacted cloud-hosted ScreenConnect cases, it is potential that menace actors first breached ConnectWise’s techniques and stole the machine keys.
Utilizing these keys, attackers might conduct distant code execution on the corporate’s ScreenConnect servers and probably entry buyer environments.
Nevertheless, it needs to be famous that ConnectWise has not confirmed whether or not this was how buyer’s cases have been breached.
Clients who spoke to BleepingComputer are pissed off by the shortage of indicators of compromise (IOCs) and data shared by ConnectWise, leaving them with little info on what occurred.
Final 12 months, a ScreenConnect flaw tracked as CVE-2024-1709 was exploited by ransomware gangs and a North Korean APT hacking group to run malware.
BleepingComputer despatched further inquiries to ConnectWise however has not heard again right now.
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK strategies behind 93% of assaults and the best way to defend towards them.
