ConnectWise Security Breach: When ScreenConnect Becomes ScreamConnect!
ConnectWise has enlisted Mandiant to tackle a breach by a “sophisticated nation state actor” affecting its IT environment and customers using ScreenConnect. While some customers were “pissed off,” ConnectWise assures us they’re on it like cats on a laser pointer, with no further suspicious activity observed.
Hot Take:
When your IT management tool becomes the cyber equivalent of the Trojan Horse, you know it’s time to call in the cavalry—aka Mandiant. ConnectWise might have been a little too connected for comfort, but at least they’re taking their security breach seriously. Let’s just hope they don’t ScreenConnect their way into any more trouble!
Key Points:
- ConnectWise experienced a breach by a “sophisticated nation-state actor” affecting some customers using ScreenConnect.
- High-profile brands like Panasonic and Honeywell use ScreenConnect, making this a supply-chain attack nightmare.
- ConnectWise hired Mandiant to investigate the breach and has increased security measures.
- A Reddit user claimed the FBI is investigating and the breach occurred in November 2024.
- A vulnerability in ScreenConnect, CVE-2025-3935, was patched, but previously exploited by attackers.
Already a member? Log in here