ConnectWise disabled five third-party extensions across partner environments after reports of unauthorized access, clarifying that core ScreenConnect software and infrastructure remain unaffected.
Initial findings point to potential extension abuse rather than a platform vulnerability.
ConnectWise's stance and third-party plugins
ConnectWise, the company that develops the ScreenConnect app, said there is no indication of a problem with its own systems or a security flaw in the software itself. According to the initial assessment, the activity appears to be related to the use of independent third-party add-ons that were installed in partner environments.
The company identified about 400 partner environments that had at least one of the specific add-ons installed. However, it stressed that the presence of the add-ons alone does not prove a breach.
As a precautionary measure, ConnectWise has disabled five third-party plugins, which are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. This activity was first detected on November 11, 2026, at around 5:47 PM UTC.
How did the attackers act?
Security researchers from Huntress reported that attackers used access to control panels to execute remote commands. Their goal was to install client programs on devices managed by organizations.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Nvidia CEO faces possible removal after investigation into personal relationships
↗
The investigation shows no evidence of a new technical issue, with evidence suggesting that the attackers used stolen credentials or gained access to active administrator sessions. The attack involves a two-step process, starting with initial access and continuing with propagation through connected technicians.
Sophos announced that it had detected similar unauthorized program installations, which were initiated by three specific identifiers and using specific addresses and websites.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)