ConnectWiseTool
- ScreenConnect
ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.From MITRE ATT&CK
Last reported yesterday, by SecurityWeek147 reports
ATT&CK techniques
6 of 136 · each with the sentence it comes from- T1684Social Engineering
“In this campaign, tokens came from multiple sources: AiTM relays behind fake sign-in pages, device-code phishing, and social engineering during a legitimate login process.”
- T1110.003Password Spraying
“Tracked as Storm-0940 and active since at least 2021, the APT is known for relying on password spraying and the exploitation of vulnerable internet-facing applications to hack into organizations across multiple sectors.”
- T1219Remote Access Tools
“Just one malicious command pasted into a Run box can open the door to infostealers, remote access tools, ransomware, or other malicious software.”
- T1036Masquerading
“A file used for potential masquerading or abuse of CCleaner components for execution or persistence.”
- T1053.005Scheduled Task
“Look for webshells and new files in your web root, along with new cron jobs, scheduled tasks, and accounts.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
147 reports · the newest 20, newest first · the exact sentence from each-
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks“China APT Uses AI Pentest Tool Artex in ConnectWise Attacks”
-
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims“In October 2026, it was reported that a Chinese nation-state actor gained access to IT management software provider ConnectWise’s cloud infrastructure, enabling the group to target downstream customers.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“Storm-0940 deploys ARTEX AI agents in hacking spree: Microsoft says that a Chinese state-aligned group is responsible for the ConnectWise Cloud Backup hack last week.”
-
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX“Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX”
-
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack“Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack”
-
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents“Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents”
-
Unboxing Phishing Kits: Huntress Examines 3 Real Kits“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants“Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants”
-
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants“Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants”
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack“China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack”
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group“Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group”
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise“Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.”
-
Attack Reduction in Huntress Managed ESPM: Disrupting ClickFix“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
-
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
-
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
-
ConnectWise customers hit by supply-chain attack linked to compromised API secret“ConnectWise customers hit by supply-chain attack linked to compromised API secret”
-
Identity Posture Assessment for Microsoft 365 | Managed ISPM“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
-
#StopRansomware: SafePay Ransomware“ScreenConnect”
-
BEC protection gap: Why orgs overestimate their protection“See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.”
Indicators in its reports
named in the reports above- 144.172.64[.]99in 3 reports
- railway[.]comin 1 report
- sites.google[.]comin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.