Malware

ConnectWise

ConnectWise is a legitimate remote monitoring and management and remote access product that has been documented as being abused by threat actors as an intrusion-enabling tool rather than as traditional self-propagating malware. In adversary operations, it can provide remote interactive access to victim systems, support execution of PowerShell commands on target machines, and enable visual surveillance through screenshot and video capture on remote hosts. Because it is signed, commonly deployed in enterprise environments, and its network activity can resemble normal administrative traffic, malicious use can be difficult to distinguish from authorized IT activity. Reported abuse has included use by criminal operators seeking covert remote access and collection from compromised Windows environments. Its observed functionality in intrusion contexts aligns most closely with remote administration and post-compromise control, including command execution and on-host monitoring.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

4 techniques

T1583.001DomainsEvidence1

The operator registered 32 throwaway domains on cheap TLDs and used 7 dynamic-DNS names to serve the same kit.

T1583.006Web ServicesEvidence1

The operator used 82 one-shot *.vercel[.]app deployments, one Netlify app, and *.github[.]io pages to host the lure kit.

T1584Compromise InfrastructureEvidence1

The operator used compromised legitimate websites — 8 confirmed in this arm, 117 conventional sites family-wide — to serve the icons8-microsoft-word-94.png kit path.

T1588.002ToolEvidence4

ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints. ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations. ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.

Initial Access

2 techniques

T1078.004Cloud AccountsEvidence1

credential-phishing serves as the initial-access vector, with a "technical interview" social-engineering pretext during which the operator drives an MFA-fatigue / SSPR-rotation sequence to seize Microsoft Entra ID accounts.

T1566.002Spearphishing LinkEvidence1

The attack begins with a phishing email linking to a disposable *.vercel[.]app page disguised as a legitimate document.

Execution

2 techniques

T1059.001PowerShellEvidence6

“PowerShell fetches an RMM installer.”

T1569.002Service ExecutionEvidence1

MITRE ATT&CK Mapping ... Execution System Services: Service Execution T1569.002 RMM agents install as system services

Persistence

2 techniques

T1078.004Cloud AccountsEvidence1

T1112Modify RegistryEvidence1

The Yanluowang threat actor enables the remote desktop service (RDP) from the registry and installs the ConnectWise tool for remote access.

Privilege Escalation

1 technique

T1078.004Cloud AccountsEvidence1

Stealth

3 techniques

T1036MasqueradingEvidence1

CISA and the FBI included technical advice victims can turn to when investigating Medusa attacks, noting that the hackers use several credential stealing tools before turning to legitimate remote monitoring software to evade detection.

T1036.005Match Legitimate Resource Name or LocationEvidence1

MITRE ATT&CK Mapping ... Defense Evasion Masquerading: Match Legitimate Name or Location T1036.005 RMM binaries are legitimate vendor software

T1078.004Cloud AccountsEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The Yanluowang threat actor enables the remote desktop service (RDP) from the registry and installs the ConnectWise tool for remote access.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Atera: Capabilities: Remote desktop access, provided through Splashtop (default) or other supported RMM software Execute commands through PowerShell or command prompt terminal Gather system information

Lateral Movement

2 techniques

T1021Remote ServicesEvidence4

The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop.

T1021.001Remote Desktop ProtocolEvidence1

The Yanluowang threat actor enables the remote desktop service (RDP) from the registry and installs the ConnectWise tool for remote access.

Collection

2 techniques

T1113Screen CaptureEvidence3

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

T1125Video CaptureEvidence2

Agent Tesla can access the victim’s webcam and record video. AsyncRAT can record screen content on targeted systems. Bandook has modules that are capable of capturing video from a victim's webcam. ... ZxShell has a command to perform video device spying.

Command and Control

3 techniques

T1090.003Multi-hop ProxyEvidence1

MITRE ATT&CK Mapping ... Command and Control Proxy: Multi-hop Proxy T1090.003 ConnectWise cloud relays proxy through OVH backend servers

T1105Ingress Tool TransferEvidence3

“PowerShell fetches an RMM installer.”

T1219Remote Access ToolsEvidence16

“The operators persuade recipients to install legitimate remote monitoring and management … tools that can give an outsider control of a computer.”

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cofense blogNews

Dec 4, 2025

2026 Phishing Threat Predictions: 5 Key Takeaways

Legitimate remote access tool increasingly abused by attackers as a stealthy method for remote access and persistence, blending in with normal IT operations and evading detection.

mitre attack websiteNews

Oct 21, 2021

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Tool referenced as capable of executing PowerShell commands on target machines.

mitre attack websiteNews

Aug 4, 2020

GOLD SOUTHFIELD, Pinchy Spider, Group G0115 | MITRE ATT&CK®

The content lists ConnectWise as software associated with PowerShell execution, screen capture, and video capture capabilities.

mitre attack websiteNews

Nov 19, 2019

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Remote administration software that can execute PowerShell commands on target machines.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ConnectWise