Huntress says it has identified six compromised managed service providers (MSPs) and 286 affected endpoints across 47 organizations in an active campaign that abuses cloud-hosted ScreenConnect instances.
Scope and timeline of the campaign
Huntress first disclosed the active campaign on Reddit, reporting that it began around 17:47 UTC the day it was observed and that “those numbers are climbing.” The firm told BleepingComputer it has so far tracked six compromised MSPs and 286+ endpoints spanning 47 organizations. ConnectWise confirmed to BleepingComputer that it is investigating reports of “malicious activity affecting a limited number of ScreenConnect partners” and that the vendor is engaged in the response.
Technique: Run Command abuse and a potential reverse pivot
According to Huntress, attackers are using ScreenConnect’s Run Command functionality to deploy ScreenConnect clients on managed endpoints, creating remote access paths that operate outside of the legitimate MSPs’ ScreenConnect environments. Huntress also warned of a potentially more dangerous “reverse-pivot” technique in which an MSP technician’s workstation can be compromised when they initiate a ScreenConnect session with an infected customer device. Huntress said it is unclear how that reverse-pivot works — including whether it exploits a software vulnerability or abuses legitimate functionality — and has not yet determined exactly how attackers are gaining initial access to affected MSP environments.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadIndicators of compromise Huntress shared
Huntress published indicators of compromise (IOCs) and attacker artifacts investigators can use to detect malicious activity. The list of IOCs and artifacts reported includes:
- Attacker relay: 185.99.255[.]28 (hostname: screen)
- C2 domains: newnewnew.gotdns[.]org, soxnewwork.homedns[.]org
- Possible additional C2: cdn007-digitaldownloads[.]com
- Secondary C2: sc.payproofkit[.]com (155.94.150[.]39, hostname: WIN-FB5CKHMU4E1)
- Stager: hxxps://ns.mo7sen[.]dev/EadF.php?p=4
- Rogue ScreenConnect client IDs: 2588ef5c15954b10, ed630cc2c873b091
- Installer pattern: /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N>
- Attacker name observed: Addmin
- Files observed: Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe, Run-Lateral-Full.bat
Huntress suggested that sequential attacker-assigned tags on deployments imply other MSPs may have been compromised earlier and urged ScreenConnect users to check their Run Command history “even if they haven’t received alerts.”
Earlier related activity tied to a rogue client ID
BleepingComputer identified an earlier malicious batch script that references one of the rogue ScreenConnect client IDs listed by Huntress, implying that at least one identifier was used in malicious activity months earlier. The file, SSA-2026-STATEMENT-15518787.bat, was uploaded to VirusTotal on July 25, 2026 and appears designed to impersonate a Social Security Administration statement.
According to the VirusTotal analysis cited by BleepingComputer, the script attempts to add Microsoft Defender exclusions, creates persistence via the Windows Startup folder and the Run registry key, and contacts amexsafekeyupdate.com to retrieve installation commands for two installers. The VirusTotal sandbox activity for that sample included downloads of ScreenConnect MSI installers from cdn007-digitaldownloads[.]com and cyberrexdesign.screenconnect[.]com. After launching the second installer, the script uses PowerShell to search running processes and services for ed630cc2c873b091; if found, it reports success to the attackers via Telegram. BleepingComputer noted it remains unclear whether the July activity and the current MSP attacks are part of the same campaign.
How MSPs, affected organizations, and security teams are responding
- MSPs: ConnectWise advised partners to avoid opening interactive ScreenConnect sessions to suspected compromised devices, to “use separate security tooling to investigate,” to review account activity, revoke active sessions, reset credentials from a trusted device, and verify multifactor authentication. ConnectWise said it would provide further information through the ConnectWise Trust Center.
- Affected organizations (customers of MSPs): Huntress and BleepingComputer’s reporting recommends that organizations check Run Command histories and look for the rogue client IDs and installer patterns Huntress released as IOCs.
- Security teams and incident responders: Huntress provided IOCs and artifact names to aid detection and recovery, and warned that telemetry currently points to compromised credentials and hijacked MSP support sessions as likely factors in the campaign.
The immediate facts leave two practical uncertainties: Huntress has not yet determined the initial access vector and the mechanics of the reported reverse-pivot remain unclear. For now, the combined guidance from Huntress and ConnectWise centers on limiting interactive ScreenConnect usage to suspected devices, hunting for the supplied IOCs, and resetting credentials from trusted endpoints while multifactor authentication is verified.
Original reporting: BleepingComputer — Active ScreenConnect attacks breach MSPs, impact dozens of organizations
