IT administration software program agency ConnectWise says a suspected state-sponsored cyberattack breached its setting and impacted a restricted variety of ScreenConnect clients.
“ConnectWise just lately discovered of suspicious exercise inside the environment that we consider was tied to a classy nation state actor, which affected a really small variety of ScreenConnect clients,” ConnectWise shared in a transient advisory.
“We have now launched an investigation with one of many main forensic specialists, Mandiant. We have now contacted all affected clients and are coordinating with regulation enforcement.”
ConnectWise is a Florida-based software program firm that gives IT administration, RMM (distant monitoring and administration), cybersecurity, and automation options for managed service suppliers (MSPs) and IT departments.
One in all its merchandise is ScreenConnect, a distant entry and assist device that permits technicians to securely connect with shopper methods for troubleshooting, patching, and system upkeep.
As first reported by CRN, the corporate now says it has applied enhanced monitoring and hardened the safety throughout its community.
In addition they state that they haven’t seen any additional suspicious exercise in buyer cases.
ConnectWise didn’t reply BleepingComputer’s questions on what number of clients had been impacted, when the breach occurred, or whether or not any malicious exercise was noticed in clients’ ScreenConnect cases.
Nevertheless, a supply instructed BleepingComputer that the breach occurred in August 2024, with ConnectWise discovering the supicious exercise in Might 2025, and that it solely impacted cloud-based ScreenConnect cases. BleepingComputer has not been in a position to independently affirm the breach dates.
In a Reddit thread, clients shared additional particulars, stating the incident is linked to a ScreenConnect vulnerability tracked as CVE-2025-3935, patched on April 24.
The CVE-2025-3935 flaw is a high-severity ViewState code injection bug brought on by unsafe deserialization of ASP.NET ViewState in ScreenConnect variations 25.2.3 and earlier.
Risk actors with privileged system-level entry can steal the key machine keys utilized by a ScreenConnect server and make the most of them to craft malicious payloads that set off distant code execution on the server.
Whereas ConnectWise didn’t state that this vulnerability was exploited on the time, it was marked as “Excessive” precedence, indicating it was both actively exploited or carried a major danger of exploitation.
The corporate additionally acknowledged that the flaw was patched on its cloud-hosted ScreenConnect platforms at “screenconnect.com” and “hostedrmm.com” earlier than it was publicly disclosed to clients.
Because the breach solely impacted cloud-hosted ScreenConnect cases, it is attainable that menace actors first breached ConnectWise’s methods and stole the machine keys.
Utilizing these keys, attackers may conduct distant code execution on the corporate’s ScreenConnect servers and probably entry buyer environments.
Nevertheless, it ought to be famous that ConnectWise has not confirmed whether or not this was how buyer’s cases had been breached.
Prospects who spoke to BleepingComputer are pissed off by the shortage of indicators of compromise (IOCs) and data shared by ConnectWise, leaving them with little info on what occurred.
Final yr, a ScreenConnect flaw tracked as CVE-2024-1709 was exploited by ransomware gangs and a North Korean APT hacking group to run malware.
BleepingComputer despatched extra inquiries to ConnectWise however has not heard again at the moment.
Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and learn how to defend in opposition to them.
