Active ScreenConnect attacks breach MSPs, impact dozens of organizations

Attackers exploited compromised ScreenConnect environments to deploy rogue remote-access clients across MSP-managed networks, turning a trusted tool into an attack vector. Because MSPs act as a force multiplier — managing infrastructure for many organizations simultaneously — a single point of compromise cascaded to 286 endpoints across 47 organizations. Attackers also targeted MSP technician workstations, threatening to gain even broader administrative access to client environments. This incident illustrates the critical risk of supply chain trust: clients implicitly trust their MSP's tooling, making MSP platforms high-value targets that require the same security rigor as the clients themselves.