ConnectWise detected suspicious activity linked to an advanced nation-state actor that affected a small number of its ScreenConnect customers. The Florida-based software
company, known for its IT management solutions, confirmed the breach and launched an investigation in collaboration with cybersecurity firm Mandiant. ConnectWise has communicated with all impacted customers and is coordinating with law enforcement.
The suspicious activity involved ConnectWise ScreenConnect, a remote desktop and support tool widely used by managed service providers and IT departments to access and manage devices remotely. Following the discovery, ConnectWise patched the vulnerability and implemented enhanced monitoring and security hardening measures. Since the patch, no further malicious activity has been observed.
While the company has not disclosed the exact timeline or the number of affected users, reports suggest the breach may have started in August 2024 and remained undetected until May 2025. ConnectWise has not confirmed whether any data was stolen or if systems beyond unauthorized access were compromised.
The incident may be linked to a ScreenConnect vulnerability tracked as CVE-2025-3935, which allowed remote code execution via stolen machine keys. ConnectWise patched this flaw on cloud-hosted instances before publicly disclosing it.
Earlier in 2024, multiple threat actors, including the Black Basta and Bl00dy ransomware groups, exploited ScreenConnect vulnerabilities CVE-2024-1709 and CVE-2024-1708, both with high severity scores. These vulnerabilities were reported to ConnectWise in February 2024 through its Trust Center.
ConnectWise continues to closely monitor the situation and will provide updates as more information becomes available.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
