ConnectWise 2026 MSP Threat Report Highlights Credential Abuse, VPN Intrusions and ClickFix
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
ConnectWise’s 2026 MSP Threat Report finds that credential abuse, poorly secured VPNs, compromised software and ClickFix drove attacks in 2025. It urges stronger identity controls, execution monitoring and protected backups.
Key points
- The report draws on 2025 incident response investigations, partner and SMB telemetry, ransomware leak sites, malicious infrastructure and external research.
- ConnectWise identifies credential abuse, VPN configuration weaknesses and user-initiated execution as recurring access methods, emphasizing exploitation of trusted workflows rather than novel exploits.
- Akira affiliates used stolen VPN credentials, moved rapidly through networks, stole data and targeted backup infrastructure before encryption; some observed activity used vulnerable drivers to disable endpoint protection.
- Supply chain campaigns, including Shai-Hulud, abused maintainer accounts and install-time scripts to steal developer secrets and propagate through trusted packages.
- Trojanized utilities associated with TamperedChef established persistence through scheduled tasks and registry Run keys, accessed browser data and enabled arbitrary process execution.
- ClickFix campaigns diversified into file-repair, consent and system-error lures while retaining manual user execution; later chains used in-memory loaders, encrypted archives and redirect services.
- Recommendations include least privilege, hardened and monitored VPN access, application controls, execution-context monitoring and isolated immutable backups. The report cautions that AI involvement often cannot be established from incident telemetry alone.
Article Details
- Publisher
- ConnectWise
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Threats affecting MSP-managed environments and SMB clients, informed by incident response investigations, partner telemetry, ransomware leak sites, malicious infrastructure monitoring, and external research.
- Key Statistics
- An unnamed security firm reported a 58% year-over-year increase in victims added to ransomware data leak sites, described as its highest recorded level; these listings are not independently confirmed incidents.
- At least 17 organizations were confirmed breached through exploitation of CVE-2025-0282 in Ivanti Connect Secure appliances in early 2025.
- Several SonicWall VPN intrusions involving inherited credentials resulted in full domain compromise in under two hours.
- A businessman in China reportedly lost over $622,000 in a July 2025 Zoom scam involving real-time face-swapping impersonation.
- Recommendations
- Continuously monitor and harden VPN infrastructure, strengthen MFA, rotate inherited credentials, and segment remote-access and backup services.
- Enforce least privilege, just-in-time administrative elevation, application allowlisting, and validation of installer hashes and publisher signatures; stage updates through controlled test rollouts.
- Correlate identity, endpoint, network, and backup telemetry, retain logs off-host, and monitor suspicious execution chains, browser-data access, and persistence mechanisms.
- Use immutable backups, isolate backup access from production credentials, and routinely test restoration procedures.
- Train users not to paste verification or recovery commands into command interpreters; require independent multi-channel verification for financial requests and restrict browser extensions.
MITRE ATT&CK
T1003.003 · NTDSAkira operators dumped Active Directory credential information using tools including Ntdsutil.T1018 · Remote System DiscoveryAkira operators used Advanced IP Scanner and SoftPerfect Network Scanner to discover network systems.T1053.005 · Scheduled TaskTamperedChef established persistence through a scheduled task.T1059.001 · PowerShellClickFix delivery chains used multi-stage PowerShell loaders, including retrieval of additional stages in memory.T1078 · Valid AccountsAkira affiliates used stolen VPN credentials, while other VPN intrusions abused inherited or reused credentials.T1133 · External Remote ServicesAttackers used SSL VPN services as entry points into SMB and MSP client networks.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers compromised package-maintainer accounts and published trojanized dependencies through public package registries.T1204.004 · Malicious Copy and PasteClickFix lures persuaded users to copy, paste, and execute attacker-provided commands; the report explicitly identifies this technique.T1218.005 · MshtaClickFix chains associated with ClearFake used MSHTA to execute remote HTA or HTML content and stage further scripts.T1486 · Data Encrypted for ImpactAkira encrypted files across multiple systems after credential theft and data staging.T1490 · Inhibit System RecoveryAkira affiliates removed or corrupted restore points and interfered with backup infrastructure to prevent recovery.T1539 · Steal Web Session CookieTamperedChef copied browser files containing cookies that could permit session hijacking.T1547.001 · Registry Run Keys / Startup FolderTamperedChef established persistence through a registry Run key.T1560.001 · Archive via UtilityAkira operators staged data archives using WinRar before exfiltration.T1562.001 · Disable or Modify ToolsAkira affiliates used vulnerable or legitimate drivers with malicious helper drivers to disable endpoint protection.
CVE
People
Threat Actors
Malware
AkiraAkira moved rapidly from access to impact, targetingFilch StealerFilch Stealer campaignsFRUITSHELLFRUITSHELL, a normal reverse shell that code comments toLAMEHUGknown as LAMEHUG), a Hugging Face API utilization whichLatrodectusLatrodectus campaignsLummaincluding Lumma, Vidar, and similar families frequentlyPROMPTFLUXincluding the emergence of PROMPTFLUX, which leveragesPROMPTSTEALevade LLM-based security scanning, and PROMPTSTEAL (alsoShai-HuludShai-Hulud 2.0: What happenedShai-Hulud 2Shai-Hulud 2.0: What happenedStealCstealers such as Vidar, Lumma, StealC, and related families,TamperedCheftracked: TamperedChef and EvilAI.Vidarincluding Lumma, Vidar, and similar families frequently
Vendors
CiscoCisco ASA Zero Day ActivityConnectWiseFrom Insights to Action: How ConnectWise Can Help .......................................................Fortinetfrom SonicWall and Fortinet, were routinely targeted by mass-scanning and credential-stuffing campaigns.IvantiIvanti (Pulse Connect Secure VPN)SonicWallthat Akira operations were logging into SonicWall SSL VPN
Products
ChatGPTtargeting browser-based AI tools like ChatGPT, Gemini, andCisco ASACisco ASA Zero Day ActivityCopilotCopilot. Researchers at LayerX demonstrated how maliciousGeminitargeting browser-based AI tools like ChatGPT, Gemini, andIvanti Connect SecureIn early 2025, Ivanti Connect Secure SSL VPN appliances wereMySonicWallMySonicWall cloud portal and accessed firewall configurationnpmjs and JavaScript, npm, was hit by a worm-style campaign inNuGetSince 2023, NuGet, the public package registry many .NETPyPIIn another ongoing supply chain compromise campaign, PyPI,SonicWall Gen7 VPNsSonicWall Gen7 VPNs that had been upgraded from older
Tools
Advanced IP Scannerused scanners such as Advanced IP Scanner or SoftPerfectFileZillaand FileZilla being utilized in exfiltration attempts.FraudGPTexploitation (e.g., WormGPT and FraudGPT).Mimikatzinformation using tools such as Mimikatz and Ntdsutil; stagedNetSupport Managerfrequently included NetSupport Manager as a remote accessntdsutilinformation using tools such as Mimikatz and Ntdsutil; stagedRCloneAkira=related incidents where we observed Rclone, WinSCP,WinRARarchives of data using tools such as WinRar; and encryptedWinSCPAkira=related incidents where we observed Rclone, WinSCP,WormGPTexploitation (e.g., WormGPT and FraudGPT).