Active campaign targeting cloud-hosted ScreenConnect began around 17:47 UTC, Huntress reports
Huntress reported an active campaign beginning around 17:47 UTC that targets cloud-hosted ScreenConnect instances. ConnectWise is reported to be investigating. Public reporting so far does not provide definitive scope counts or attribution.
- Urgency
- L4
- 85
- 75
- 100
- 100
- 80
At a glance
Huntress posted that an active campaign started around 17:47 UTC targeting cloud-hosted ScreenConnect instances. BleepingComputer reports ConnectWise is investigating the activity and that the campaign uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
- Huntress reported an active campaign beginning around 17:47 UTC that targets cloud-hosted ScreenConnect instances. ConnectWise is reported to be investigating. Public reporting so far does not provide definitive scope counts or attribution.
CHRONOS Wire · November 12 · Alert 4
What happened
Security researchers report an active campaign is targeting cloud-hosted ScreenConnect instances used by managed service providers, and attackers are deploying rogue remote‑access clients to customer devices.
Why it matters
The campaign is reported active and leverages MSP remote-management infrastructure, so rapid vendor and customer coordination may limit further access via compromised management tooling.
CHRONOS Bottom Line
Huntress reports an active campaign began around 17:47 UTC targeting cloud-hosted ScreenConnect instances, and ConnectWise is investigating; reporting states the campaign deploys rogue remote-access clients to customer devices.
Full detail
What changed
Huntress posted that an active campaign began around 17:47 UTC targeting cloud-hosted ScreenConnect instances, and BleepingComputer reports ConnectWise is investigating the activity.
What is genuinely new
Public reporting from Huntress and BleepingComputer documents an active campaign, with Huntress stating the campaign started around 17:47 UTC and targeting cloud-hosted ScreenConnect instances; ConnectWise is reported to be investigating.
Detailed analysis
Public reporting indicates an active campaign leveraging compromised ScreenConnect environments used by MSPs, with Huntress stating it began around 17:47 UTC and BleepingComputer reporting that ConnectWise is investigating. The reporting says the campaign deploys rogue remote-access clients to customer devices. No public technical indicators, comprehensive scope, or attribution were provided in the cited reporting.
U.S. Impact
U.S. Impact assessment pending.