Loading story…
Threat actors including Black Basta have been actively exploiting recent ConnectWise ScreenConnect vulnerabilities to gain access to victim environments, then using that foothold to deepen control and prepare for follow-on attacks. Trend Micro reported post-compromise reconnaissance against domain controllers, including enumeration of domain computers, trusts, domain controllers, and local administrators, indicating efforts to map enterprise networks and identify privileged access.
Attackers were also observed deploying additional remote management tools to maintain persistence and broaden remote access. In compromised environments, they abused BITSAdmin to download and execute another ScreenConnect client from transfer[.]sh, and in several European targets—mostly in Belgium—they installed trial versions of Atera RMM using msiexec parameters linked to an Outlook email account and account identifiers. Researchers warned that the activity could quickly progress to ransomware deployment, data theft, operational disruption, and financial losses, making immediate patching to the latest ScreenConnect version critical.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro warned that exploitation of the ScreenConnect flaws could lead to ransomware deployment, data compromise, operational disruption, and financial loss. The company advised organizations to immediately update to the latest ScreenConnect version.
In observed intrusions, attackers ran reconnaissance commands against domain controllers to enumerate domain computers, trusts, domain controllers, and local administrators. They also abused BITSAdmin to download and execute another ScreenConnect client from transfer[.]sh and deployed trial Atera RMM instances at several mostly Belgian European targets using msiexec.
By late February 2024, Trend Micro observed threat actor groups, including Black Basta, exploiting recently disclosed ConnectWise ScreenConnect vulnerabilities in the wild. The activity showed attackers gaining access to compromised environments and using that foothold for follow-on intrusion activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ConnectWise ScreenConnect** disclosed a critical vulnerability, **CVE-2026-3564** (**CVSS 9.0**), affecting versions prior to **26.1**. The flaw stems from ScreenConnect storing unique per-instance machine keys and related cryptographic material in plaintext server configuration files, creating a path for attackers under certain conditions to extract those keys and abuse them for unauthorized access. The issue is classified as **CWE-347: Improper Verification of Cryptographic Signature**, and successful exploitation can undermine confidentiality, integrity, and availability in environments that rely on ScreenConnect for remote access. With the exposed machine keys, an attacker could forge or manipulate session authentication tokens, hijack legitimate sessions, and elevate access without user interaction. ConnectWise rated the issue as high priority, and the **Centre for Cybersecurity Belgium** urged organizations to patch immediately, monitor for suspicious activity, and treat updates as protection against future exploitation rather than proof that no prior compromise occurred. The vendor states the issue is fixed in **version 26.1**, making rapid remediation and post-patch review important for on-premises deployments.
Jul 23, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Two separate social-engineering campaigns are abusing legitimate remote access software to obtain interactive control of victim systems. One phishing operation uses **fake party invitation** emails—often appearing to come from **compromised email accounts**—to lure recipients to a spoofed invitation webpage that pressures them to download and run an `RSVPPartyInvitationCard.msi` installer. Malwarebytes researchers reported the activity primarily targeting the **UK**, with the MSI using `msiexec.exe` to silently install the **ScreenConnect** remote support client, enabling attackers to access files, credentials, and other sensitive data. A different, automated campaign is targeting **RustDesk** users by bombarding exposed RustDesk IDs with unsolicited connection requests labeled **“Go Client”** from many IPs/IDs. The activity is described as **not exploiting a RustDesk vulnerability**; instead it relies on users mistakenly clicking **Accept**, after which the botnet can run scripted actions to deploy additional malware and establish persistence. Recommended mitigations include refusing unexpected connection prompts and configuring RustDesk to require a **password** (and strong credentials) for session acceptance, reducing the risk of one-click authorization leading to takeover.
Jun 29, 2026