Active ScreenConnect campaign hits MSP environments ConnectWise and Huntres are active intrusion monitoring set up abusing ScreenConnect environments to push remote clients to access remote clients' devices. Antours identified 6 MSPs, 286 affected endpoints, and affected 47 organizations, while disabling five extensions from a third-party screen in approximately 400 partner environments as a containment measure. The key point is Tradecraft, not a confirmed software flaw: Operators use legitimate screen functions, including Run Command, to establish concurrent remote access and potentially compromising technical work during live sessions. Disabling extensions does not remove persistence or unauthorized access already deployed. 🛰️ Open sources - closed narratives.

Active ScreenConnect campaign hits MSP environments ConnectWise and Huntres are active intrusion monitoring set up abusing ScreenConnect environments to push remote clients to access remote clients' devices. Antours identified 6 MSPs, 286 affected endpoints, and affected 47 organizations, while disabling five extensions from a third-party screen in approximately 400 partner environments as a containment measure. The key point is Tradecraft, not a confirmed software flaw: Operators use legitimate screen functions, including Run Command, to establish concurrent remote access and potentially compromising technical work during live sessions. Disabling extensions does not remove persistence or unauthorized access already deployed. 🛰️ Open sources - closed narratives.