Huntress Reports Active ScreenConnect Attacks Affecting 47 Organizations
Summary
Huntress says an active campaign compromised six MSPs and affected 286+ endpoints across 47 organizations, using ScreenConnect Run Command to deploy rogue clients. ConnectWise is investigating; the initial access method remains unknown.
Key points
- Huntress reports six compromised MSPs and 286+ affected endpoints across 47 organizations; the count was still rising.
- Attackers reportedly used ScreenConnect Run Command to deploy rogue clients on customer endpoints, enabling remote access outside the legitimate MSP environment.
- Huntress says its telemetry points to compromised credentials and hijacked MSP support sessions, but the initial access method is undetermined.
- ConnectWise is investigating and advised partners to avoid interactive sessions with suspected compromised devices, review account activity, revoke sessions, reset credentials from a trusted device, and verify multifactor authentication.
- Huntress warned of a possible reverse-pivot technique that could expose an MSP technician’s workstation during a session; how it works is unclear.
- A July script sample used one of the rogue client IDs and appeared to create persistence and add Microsoft Defender exclusions; whether that activity is connected to the current campaign is unclear.
Article Details
- Victim Organization
- Not disclosed; six compromised MSPs and customer organizations were reported
- Incident Type
- Active malware campaign using compromised ScreenConnect environments to deploy rogue remote-access clients
- Incident Date
- 2026-11-11
- Disclosure Date
- 2026-11-11
- Operational Impact
- Huntress reported six compromised MSPs and 286+ affected endpoints across 47 organizations, with the number of victims continuing to rise. Attackers used ScreenConnect Run Command to deploy clients that provided remote access outside the legitimate MSP environment. A potentially more dangerous reverse-pivot technique was reported, but its operation and impact were unclear.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amexsafekeyupdate[.]com | The earlier malicious batch script contacted this domain to retrieve installation commands. |
| DOMAIN | cdn007-digitaldownloads[.]com | Listed as a possible additional C2 and associated with ScreenConnect MSI installer downloads in VirusTotal sandbox activity. |
| DOMAIN | cyberrexdesign[.]screenconnect[.]com | Host from which VirusTotal sandbox activity associated with the malicious script downloaded a ScreenConnect MSI installer. |
| DOMAIN | digitaldownloads[.]com | Listed by Huntress as a potential IOC and associated with installer downloads in the earlier malicious-script activity. |
| DOMAIN | newnewnew[.]gotdns[.]org | C2 domain identified in the campaign indicators. |
| DOMAIN | sc[.]payproofkit[.]com | Secondary C2 domain identified in the campaign indicators. |
| DOMAIN | soxnewwork[.]homedns[.]org | C2 domain identified in the campaign indicators. |
| IPV4 | 155[.]94[.]150[.]39 | IP address listed as infrastructure for the secondary C2. |
| IPV4 | 185[.]99[.]255[.]28 | Attacker relay infrastructure identified in the reported campaign. |
| URL | hxxps[:]//ns[.]mo7sen[.]dev/EadF.php?p=4 | Stager URL identified in the campaign indicators. |
MITRE ATT&CK
T1059.001 · PowerShellThe earlier malicious batch script used PowerShell to search processes and Windows services for a rogue ScreenConnect client ID.T1219 · Remote Access ToolsAttackers deployed rogue ScreenConnect clients to provide remote access to managed endpoints.T1547.001 · Registry Run Keys / Startup FolderThe earlier malicious batch script created persistence through the Windows Startup folder and the Run registry key.