Skip to main content
Apexward Pulse
Type Incident

ConnectWise ScreenConnect

Active ScreenConnect attacks breach MSPs, impact dozens of organizations

1 source

At a glance

Low
30-day window, from the last update
Evidence-weighted, not popularity
Why Low

Low rather than Medium: exposure is scored at a default because we cannot see your systems or suppliers. If it touches your systems or suppliers, treat it as Medium.

Briefing

There is no written leader briefing for this story yet. These questions come from the facts we hold.

Questions to ask IT

  • Does this reporting name any supplier, product or service we rely on?
  • Would our monitoring spot an attack like this, and who would we call if it did?

Next steps

  1. Confirm whether the affected organisation is a supplier or partner, and what contingency exists

Summary

  • ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.

Read the original reportBleepingComputer(opens in a new tab)

Pulse

Last change 48m ago · Next recheck 12 Nov 2026, 02:06 UK time

  1. Story12 Nov 2026, 00:06 UK time · 48m ago

    Linked reporting from BleepingComputer (independent original reporting).

    Read source (BleepingComputer)

1 entry so far. The timeline chart appears once this story has more history.

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Active ScreenConnect attacks breach MSPs, impact dozens of organisations

  • ProbableSummary fact75% confidence

    ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.