ScreenConnect Supply Chain Compromise - 20261112003

Overview

The WASOC has received intelligence reporting a supply chain compromise involving ScreenConnect and MSP Vendors and Partners. Threat actors are abusing third-party RMM+ extensions within ScreenConnect environments to execute remote commands.

What has been observed?

The WASOC has observed malicious activity within the WA Government Sector and advises agencies to contact their MSP Vendors and Partner utilising ScreenConnect to ensure the security of their environments.

Recommendation

The WA SOC recommends:

• Review Software Inventories for ScreenConnect and associated Third Party Extensions.
• Review guidance from ConnectWise and ensure Partner and MSPs are abreast of the latest advice.
• ConnectWise Advisory: https://www.connectwise.com/company/trust/advisories
• Reference: https://www.huntress.com/blog/sckit-worm-rogue-screenconnect