IT administration software program agency ConnectWise says a suspected state-sponsored cyberattack breached its setting and impacted a restricted variety of ScreenConnect prospects.
“ConnectWise just lately realized of suspicious exercise inside the environment that we imagine was tied to a complicated nation state actor, which affected a really small variety of ScreenConnect prospects,” ConnectWise shared in a transient advisory.
“We’ve got launched an investigation with one of many main forensic specialists, Mandiant. We’ve got contacted all affected prospects and are coordinating with regulation enforcement.”
ConnectWise is a Florida-based software program firm that gives IT administration, RMM (distant monitoring and administration), cybersecurity, and automation options for managed service suppliers (MSPs) and IT departments.
Certainly one of its merchandise is ScreenConnect, a distant entry and assist device that enables technicians to securely connect with consumer methods for troubleshooting, patching, and system upkeep.
As first reported by CRN, the corporate now says it has carried out enhanced monitoring and hardened the safety throughout its community.
In addition they state that they haven’t seen any additional suspicious exercise in buyer situations.
ConnectWise didn’t reply BleepingComputer’s questions on what number of prospects had been impacted, when the breach occurred, or whether or not any malicious exercise was noticed in prospects’ ScreenConnect situations.
Nevertheless, a supply instructed BleepingComputer that the breach occurred in August 2024, with ConnectWise discovering the supicious exercise in Could 2025, and that it solely impacted cloud-based ScreenConnect situations.
In a Reddit thread, prospects shared additional particulars, stating the incident is linked to a ScreenConnect vulnerability tracked as CVE-2025-3935, patched on April 24.
The CVE-2025-3935 flaw is a high-severity ViewState code injection bug brought on by unsafe deserialization of ASP.NET ViewState in ScreenConnect variations 25.2.3 and earlier.
Risk actors with privileged system-level entry can steal the key machine keys utilized by a ScreenConnect server and make the most of them to craft malicious payloads that set off distant code execution on the server.
Whereas ConnectWise didn’t state that this vulnerability was exploited on the time, it was marked as “Excessive” precedence, indicating it was both actively exploited or carried a major threat of exploitation.
The corporate additionally said that the flaw was patched on its cloud-hosted ScreenConnect platforms at “screenconnect.com” and “hostedrmm.com” earlier than it was publicly disclosed to prospects.
Because the breach solely impacted cloud-hosted ScreenConnect situations, it is doable that risk actors first breached ConnectWise’s methods and stole the machine keys.
Utilizing these keys, attackers might conduct distant code execution on the corporate’s ScreenConnect servers and doubtlessly entry buyer environments.
Nevertheless, it ought to be famous that ConnectWise has not confirmed whether or not this was how buyer’s situations had been breached.
Clients who spoke to BleepingComputer are pissed off by the dearth of indicators of compromise (IOCs) and data shared by ConnectWise, leaving them with little info on what occurred.
BleepingComputer despatched further inquiries to ConnectWise however has not heard again right now.
Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK strategies behind 93% of assaults and find out how to defend in opposition to them.
