Active campaign hits MSPs through ScreenConnect: Run Command pushes rogue clients to customer hosts, and a trap targets technicians who connect
- Do now (both vendors): don't open interactive ScreenConnect sessions to suspected compromised hosts; investigate with separate tooling. Reset ScreenConnect passwords, revoke sessions, enforce MFA and remove unknown users from a trusted device.
- On-prem partners: ConnectWise can't disable the extensions for you; disable the five listed extensions yourself, keep their install records and don't reinstall them.
- Check history: review Run Command, Toolbox and extension-install records even without alerts. BleepingComputer quotes Huntress saying sequential attacker tags suggest earlier MSP victims.
- Not yet known: how the attackers got in (Huntress's telemetry points to compromised credentials and hijacked support sessions) and whether the technician pivot uses a software flaw.
- IOCs and a step-by-step response are in the linked hunt and playbook.
Sources: ConnectWise Trust Center advisory: ScreenConnect precautionary extension disabling and partner guidance (Nov 11, 2026, 22:45 UTC) · Huntress Support: 2026 - November - ScreenConnect (indicators and response steps) · Huntress on X (Nov 11, 2026) · BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations (Nov 11, 2026)