Industry NewsNovember 13, 202610 min read

My MSP Tech

Active ScreenConnect Attacks: What MSP Customers Need to Know

Quick Answers for Property & Facility Managers

What should a business do about the active ScreenConnect attacks?

Ask your MSP to confirm whether ScreenConnect and related third-party extensions are present, whether your environment was exposed, and what monitoring has found. Require multifactor authentication, session and command-log review, endpoint scans, credential rotation where appropriate, and written incident-status updates. If unauthorized access is suspected, activate incident-response procedures immediately.

Does having a ScreenConnect extension mean an organization was hacked?

No. ConnectWise identified approximately 400 partner environments with potentially related third-party extensions and disabled five as a precaution, but the presence of an extension alone does not prove compromise. Your MSP should investigate authentication logs, command activity, endpoint software, persistence mechanisms, and unusual administrative actions before determining exposure.

Why are ScreenConnect attacks a serious risk for MSP customers?

An MSP remote-management environment can provide privileged access across many customer systems. In this campaign, attackers reportedly used compromised ScreenConnect environments to deploy unauthorized remote-access clients to customer endpoints. That creates risks involving data theft, ransomware, credential abuse, operational disruption, and compliance reporting obligations.

What the Active ScreenConnect Attacks Mean for Commercial IT Buyers

ConnectWise is investigating an active malware campaign targeting managed service providers through compromised ScreenConnect environments. Huntress reported six compromised MSPs, 286 affected endpoints, and 47 impacted organizations at the time of the initial report, with victim counts continuing to rise. ConnectWise also disabled five third-party extensions across approximately 400 partner environments as a precaution.

For IT directors, operations leaders, and business owners, the central issue is concentration of privilege. Remote monitoring and management platforms allow an MSP to administer servers, workstations, applications, and network-connected systems across multiple locations. If an attacker abuses that control plane, the impact can extend beyond one employee device or one building.

The reported campaign involved unauthorized remote-access software being deployed to customer devices through compromised ScreenConnect environments. The five extensions ConnectWise identified were Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. ConnectWise stated that the presence of those extensions does not by itself establish that an environment was compromised.

Why Remote-Management Platforms Are a High-Value Attack Surface

ScreenConnect and similar tools are legitimate components of managed IT services. They support help desk response, patching, software deployment, server administration, and emergency troubleshooting across offices, warehouses, medical practices, professional services firms, manufacturing sites, and property portfolios.

The same capabilities make these platforms attractive to attackers. A compromised MSP account or extension may provide a path to execute commands at scale, install software, establish persistence, or bypass normal user interaction. The risk is particularly significant for SMB and mid-market organizations that rely on an MSP for identity administration, Microsoft 365 support, endpoint security, backup operations, and network management.

Organizations should distinguish between a normal remote-support session and an unauthorized client or command. A trusted tool can be abused without the underlying vendor being inherently unsafe. The buyer question is whether the provider has strong access governance, independent security monitoring, documented change control, and a tested incident-response process.

Immediate Verification Steps for IT Directors and Operations Leaders

Commercial organizations should request a documented review from their MSP rather than relying on a general assurance that systems are safe. The review should cover the provider's ScreenConnect deployment, cloud-hosted or self-hosted instances, third-party extensions, administrative identities, API credentials, and endpoint inventory.

Confirm whether any of the five potentially related extensions were installed and whether ConnectWise disabled them in the relevant environment.
Review ScreenConnect authentication events, administrative sessions, Run Command activity, extension activity, and unusual changes to customer groups or policies.
Search endpoint detection and response telemetry for unauthorized ScreenConnect clients, unexpected services, new scheduled tasks, suspicious scripts, and unusual outbound connections.
Verify that multifactor authentication is enforced for ScreenConnect, identity-provider accounts, RMM tools, privileged email accounts, and remote-access applications.
Rotate credentials, API keys, shared secrets, and service-account passwords when exposure cannot be ruled out.
Preserve logs and evidence before rebuilding affected devices or removing suspicious software.
Escalate suspected compromise to an incident-response provider, cyber-insurance breach team, legal counsel, and applicable regulators.

For multi-site companies, request results by location, business unit, and endpoint group. A property operator, manufacturer, healthcare organization, or professional services firm needs to know whether exposure reached corporate offices, tenant-support systems, building-management networks, production environments, or regulated data stores.

What a Qualified MSP Should Provide During the Investigation

A capable managed IT or managed cybersecurity provider should provide clear scope, ownership, and timing. Buyers should ask which team is investigating the issue, whether a 24/7 SOC or MDR service is monitoring endpoints, how alerts are escalated, and what service-level agreement applies to suspected compromise.

Useful provider deliverables include an asset list, affected-versus-unaffected endpoint status, timeline of relevant activity, containment actions, credential-rotation record, remediation plan, and executive summary. The provider should also explain whether third-party tools, subcontractors, or integrations created additional access paths.

Contract terms matter. Review notification deadlines, breach cooperation, log retention, forensic support, cyber-insurance requirements, data ownership, privileged-access controls, and termination procedures. An MSP that cannot identify who can access customer systems, when they can access them, and how that access is recorded represents an avoidable operational risk.

For new provider evaluations, compare support hours, response times, escalation paths, security certifications, company size served, industry experience, endpoint coverage, vulnerability-management practices, and incident-response capability. A low monthly fee does not compensate for weak control over a platform with broad administrative privileges.

Compliance Implications Across Regulated and Contract-Driven Businesses

The incident does not automatically create a reportable breach for every affected company. Obligations depend on the systems accessed, data involved, contractual terms, jurisdiction, and evidence developed during the investigation. Still, organizations should involve compliance and legal stakeholders early.

Healthcare organizations should evaluate whether systems containing electronic protected health information fall within a HIPAA risk analysis or breach assessment. Defense contractors and suppliers should consider whether controlled unclassified information and CMMC 2.0 security practices are implicated. NIST SP 800-171 and the NIST Cybersecurity Framework can help structure access control, audit logging, incident response, and recovery activities.

Organizations subject to SOC 2 commitments, PCI DSS requirements, or the FTC Safeguards Rule should document investigation and corrective actions in a way that supports control evidence. The FTC Safeguards Rule emphasizes a written information-security program and safeguards appropriate to risk; remote administrative access and service-provider oversight are relevant areas for review.

Manufacturers and facilities teams should also account for operational technology, building systems, and manufacturer warranties. Removing remote-management agents from production equipment, controllers, security systems, or building-management platforms without a documented plan can disrupt operations or affect support agreements. Coordinate remediation with equipment owners and authorized manufacturers where required.

How to Reduce MSP and Remote-Access Risk After Containment

After immediate investigation, organizations should reduce unnecessary privilege and improve visibility. Apply least privilege to technician accounts, separate administrative identities from daily email accounts, require phishing-resistant MFA where practical, and restrict remote tools to approved applications and managed devices.

Maintain an authoritative inventory of remote-access software and review it regularly. Endpoint detection and response should alert on unauthorized tools, service creation, command interpreters, persistence, and lateral movement. Vulnerability management should include remote-management servers, plugins, integrations, and exposed administrative interfaces.

Require providers to document tenant separation, access approval, session recording, command logging, security monitoring, backup protection, and disaster-recovery procedures. Test whether a provider can isolate one customer without taking an entire portfolio offline. For organizations with critical operations, pair managed IT support with managed detection and response, immutable backups, tested recovery objectives, and an incident-response retainer.

The objective is not to eliminate remote management. It is to make remote management controlled, observable, recoverable, and contractually accountable. SMB and mid-market companies can obtain those protections without building a large internal security operations center, but they must select an MSP that treats privileged access as a security service rather than merely a convenience.

Questions to Ask Your Current or Prospective MSP

Which remote-management and remote-support platforms can access our endpoints, servers, Microsoft 365 tenant, network, and cloud accounts?
How are third-party extensions reviewed, approved, patched, monitored, and disabled?
Do technicians use unique accounts and multifactor authentication, and are privileged sessions logged?
What is the guaranteed response time for suspected unauthorized access?
Which EDR, MDR, SOC, vulnerability-management, backup, and incident-response capabilities are included?
How will you notify us if your environment or a subcontractor is compromised?
Can you provide evidence of industry experience, security certifications, compliance support, and successful recovery testing?
What happens to administrative access, documentation, backups, and logs if the agreement ends?

The ScreenConnect campaign is a reminder that an MSP is part of a company's security boundary. IT leaders should use the incident to test provider transparency, privileged-access controls, monitoring depth, and response readiness before the next remote-management platform compromise creates business disruption.

Frequently Asked Questions

How much does it cost to improve security around ScreenConnect and other RMM tools?

Cost depends on endpoint count, locations, compliance requirements, existing licenses, and whether the organization needs EDR, MDR, 24/7 SOC monitoring, incident-response retainers, or a platform redesign. Buyers should compare total risk-reduction value rather than a remote-support license alone. A qualified MSP should provide a scoped assessment, remediation priorities, recurring service fees, project charges, and response-time commitments.

Should a company replace ScreenConnect after this campaign?

Replacement is not automatically required. The immediate priority is determining whether the environment was exposed, disabling affected extensions, investigating logs and endpoints, and strengthening authentication and access controls. A replacement may be justified if the provider cannot establish trustworthy monitoring, tenant isolation, administrative accountability, or incident response. Any migration should preserve support coverage, documentation, backups, and business continuity.

What contractual protections should businesses require from an MSP?

Contracts should define privileged-access controls, MFA requirements, logging, notification timelines, security responsibilities, subcontractor oversight, incident-response cooperation, evidence preservation, backup protection, and recovery support. Include measurable SLAs for critical incidents, named escalation paths, data ownership, cyber-insurance cooperation, and secure offboarding. These terms help operations leaders evaluate accountability before a provider-side event affects business systems.

Can an MSP prevent every remote-management compromise?

No provider can promise zero cyber risk. A mature MSP can reduce likelihood and impact through least privilege, MFA, secure configuration, extension governance, EDR or MDR, vulnerability management, centralized logging, backup isolation, and tested incident response. Buyers should assess how quickly the provider can detect unauthorized activity, isolate affected endpoints, communicate scope, and restore operations.

How do ScreenConnect attacks affect HIPAA, CMMC 2.0, NIST, SOC 2, or PCI DSS programs?

The effect depends on whether regulated data, systems, or control evidence were accessed. Organizations should document the investigation, access review, containment, remediation, and management decisions. HIPAA entities may need a breach assessment; CMMC 2.0 and NIST-aligned programs should review access control, audit, and incident-response practices; SOC 2 and PCI DSS teams should evaluate control impact and evidence requirements.

Find a Qualified Managed IT & Cybersecurity Contractor

Need help acting on this? Browse managed IT & cybersecurity providers in your area, or explore managed IT services like preventative maintenance, inspections, and emergency response. Are you a contractor? List your business on My MSP Tech to reach IT and operations leaders actively searching for help.

Sources

Originally sourced from BleepingComputer

ScreenConnect attacksmanaged service providersMSP cybersecurityremote access securitymanaged IT servicesincident response