ScreenConnect Attacks Compromise ≥ 288 Endpoints in 48 Organizations via Rogue Remote‑Access Clients

O que aconteceu

Attackers used rogue ScreenConnect client binaries delivered through compromised third‑party extensions, reaching 288 endpoints in 48 organizations; ConnectWise disabled the five affected extensions and launched a forensic investigation.

Por que isso importa para confiança e conformidade

• The incident tests the control objective of third‑party risk management, showing that oversight of extensions is essential for audit readiness across frameworks.
• Demonstrates need for continuous monitoring of third‑party extensions as evidence of control effectiveness.
• Supports audit readiness by mapping extension‑oversight to vendor‑risk control objectives.

Who is affected

Recommended actions

1. Inventory and verify all ScreenConnect extensions; remove unverified add‑ons.
2. Rotate partner credentials and enforce MFA for extension management.
3. Enable detailed remote‑session logging and integrate with a SIEM.