ConnectWise has disabled five third‑party extensions in partner environments after reports of unauthorized access to its ScreenConnect remote‑support platform. The move follows a wave of attacks that have reportedly affected at least 288 endpoints across 48 organisations, with rogue clients being used to gain entry.
In an advisory posted on its website, the company said there is no evidence that the incident involves a compromise of its own infrastructure or a vulnerability in the ScreenConnect software itself. The advisory also noted that the attacks appear to be centred on the use of unauthorised client software rather than a flaw in the core product.
ConnectWise described the step as precautionary, stating that disabling the extensions would limit potential exposure while the company investigates the source of the activity. The firm has not yet identified the specific third‑party extensions that were affected.
"Our initial assessment suggests the activity may involve," the advisory read, though it stopped short of providing further detail. The company has urged partners to review their own security configurations and remain vigilant for signs of similar intrusion attempts.
While the incident has not yet been linked to a broader compromise of ConnectWise’s infrastructure, the company is continuing its investigation and will provide updates as more information becomes available. Organisations using ScreenConnect are advised to keep their software and extensions up to date and to monitor for any unusual activity.
<small>Source: The Hacker News — read the original story there.</small>
