ConnectWise investigates ScreenConnect malware campaign targeting managed service providers

Situation Overview

On 11 November 2026, ConnectWise said it is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. The campaign is described as affecting MSPs and, through them, dozens of organizations, with the rogue clients installed on customer systems to enable remote access. The activity is framed as ongoing, with ConnectWise working to assess the scope and impact of the intrusion. No specific economic or market effects were reported in the cluster. The next concrete step mentioned is ConnectWise’s ongoing investigation into the campaign’s scope and remediation actions for affected environments.

Geopolitical Implications

1. 01

   MSP supply-chain access via remote-access tooling increases cross-organization compromise risk and containment difficulty.

2. 02

   Active exploitation of widely used remote-access software can accelerate defensive coordination among MSPs and customers.

Key Signals

• —

  ConnectWise updates on indicators of compromise and remediation steps for ScreenConnect environments

• —

  Reports of additional affected MSPs and the number of customer organizations impacted

• —

  Any confirmed attribution or disclosure of the malware’s command-and-control and persistence mechanisms

Topics & Keywords

Market Impact Analysis

AI Threat Assessment

Event Timeline