What happened. Huntress's SOC flagged an active campaign against cloud-hosted ConnectWise ScreenConnect instances that it says started around 17:47 UTC (12:47 PM ET) on Nov 11. As of its first public update it was tracking six compromised MSPs and 286+ endpoints across 47 organizations, with numbers climbing. ConnectWise told BleepingComputer it is aware of malicious activity affecting "a limited number of ScreenConnect partners" and is investigating with Huntress.
How it works. Once inside an MSP's ScreenConnect tenant, the attacker uses the built-in Run Command feature to install a second, attacker-controlled ScreenConnect client on every managed endpoint. That gives them their own remote-access line into customer machines that survives even if the MSP locks down its own console. Huntress also warned of a possible reverse pivot: a technician's own workstation may get compromised when they open a session to an infected customer device. It is not yet clear whether that is a software bug or abuse of normal features, and Huntress has not confirmed initial access, though its telemetry points to stolen credentials and hijacked support sessions. No CVE has been tied to the campaign so far.
Why this matters to an enterprise. One MSP console reaches dozens of customers at once, which is why remote-support tools are a favorite ransomware on-ramp. Huntress says the attacker's sequential tags suggest other MSPs were hit earlier, so a quiet console today is not proof you are clean. If an outside provider supports your endpoints through ScreenConnect, you are in scope even if you never bought the product yourself.
Do now. Review ScreenConnect Run Command history even without alerts, and hunt for rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091 and installer URLs ending in ScreenConnect.ClientSetup.msi?...&c=Exploited. Do not open interactive sessions to suspect devices; investigate with separate tooling. Revoke active sessions, reset technician credentials from a clean device, and confirm MFA on every account. If you are an MSP customer, ask your provider today whether they run cloud ScreenConnect and what their Run Command logs show.