IT administration software program agency ConnectWise says a suspected state-sponsored cyberattack breached its setting and impacted a restricted variety of ScreenConnect clients.
“ConnectWise lately discovered of suspicious exercise inside the environment that we consider was tied to a complicated nation state actor, which affected a really small variety of ScreenConnect clients,” ConnectWise shared in a temporary advisory.
“We now have launched an investigation with one of many main forensic specialists, Mandiant. We now have contacted all affected clients and are coordinating with legislation enforcement.”
ConnectWise is a Florida-based software program firm that gives IT administration, RMM (distant monitoring and administration), cybersecurity, and automation options for managed service suppliers (MSPs) and IT departments.
One in every of its merchandise is ScreenConnect, a distant entry and assist device that enables technicians to securely connect with shopper methods for troubleshooting, patching, and system upkeep.
As first reported by CRNthe corporate now says it has applied enhanced monitoring and hardened the safety throughout its community.
In addition they state that they haven’t seen any additional suspicious exercise in buyer cases.
ConnectWise didn’t reply BleepingComputer’s questions on what number of clients had been impacted, when the breach occurred, or whether or not any malicious exercise was noticed in clients’ ScreenConnect cases.
Nonetheless, a supply advised BleepingComputer that the breach occurred in August 2024, with ConnectWise discovering the supicious exercise in Might 2025, and that it solely impacted cloud-based ScreenConnect cases. BleepingComputer has not been in a position to independently affirm the breach dates.
Jason Slagle, President of managed service supplier CNWR, advised BleepingComputer that solely a really small variety of clients had been impacted, suggesting the menace actor carried out a focused assault in opposition to particular organizations.
In a Reddit thread, clients shared additional particulars, stating the incident is linked to a ScreenConnect vulnerability tracked as CVE-2025-3935patched on April 24.
The CVE-2025-3935 flaw is a high-severity ViewState code injection bug brought on by unsafe deserialization of ASP.NET ViewState in ScreenConnect variations 25.2.3 and earlier.
Risk actors with privileged system-level entry can steal the key machine keys utilized by a ScreenConnect server and make the most of them to craft malicious payloads that set off distant code execution on the server.
Whereas ConnectWise didn’t state that this vulnerability was exploited on the time, it was marked as “Excessive” precedence, indicating it was both actively exploited or carried a big threat of exploitation.
The corporate additionally acknowledged that the flaw was patched on its cloud-hosted ScreenConnect platforms at “screenconnect.com” and “hostedrmm.com” earlier than it was publicly disclosed to clients.
Because the breach solely impacted cloud-hosted ScreenConnect cases, it is attainable that menace actors first breached ConnectWise’s methods and stole the machine keys.
Utilizing these keys, attackers may conduct distant code execution on the corporate’s ScreenConnect servers and doubtlessly entry buyer environments.
Nonetheless, it must be famous that ConnectWise has not confirmed whether or not this was how buyer’s cases had been breached.
Prospects who spoke to BleepingComputer are pissed off by the shortage of indicators of compromise (IOCs) and knowledge shared by ConnectWise, leaving them with little data on what occurred.
Final 12 months, a ScreenConnect flaw tracked as CVE-2024-1709 was exploited by ransomware gangs and a North Korean APT hacking group to run malware.
BleepingComputer despatched further inquiries to ConnectWise however has not heard again at the moment.
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK strategies behind 93% of assaults and the right way to defend in opposition to them.
