ConnectWise ScreenConnect Breach Tied to Nation-State Threat Actor

ConnectWise, the software company behind the popular ScreenConnect remote access and support tool, has disclosed that it recently fell victim to a cyberattack attributed to a sophisticated nation-state threat actor. The breach reportedly affected a small subset of ScreenConnect customers, although the exact scope and origin of the attack remain undisclosed.

This development adds to growing concerns about the security of remote access software, which is often targeted due to its elevated system privileges and access to sensitive customer environments.

Key Details of the Breach

In a brief advisory released on May 28, 2025, ConnectWise confirmed:

To investigate the incident, the company has enlisted Google Mandiant, a leading cybersecurity firm specializing in threat intelligence and incident response. The company stated that all affected customers have been notified but did not provide details on:

• The number of impacted customers

• The timeline of the breach

• The identity of the threat actor

The breach was first reported by industry publication CRN.

Potential Link to Known Vulnerabilities

Although not confirmed by ConnectWise, the attack may be connected to recent vulnerabilities in the ScreenConnect platform. Specifically, in April 2025, ConnectWise patched a high-severity vulnerability, CVE-2025-3935, which:

• Received a CVSS score of 8.1

• Affected ScreenConnect versions 25.2.3 and earlier

• Could be exploited for ViewState code injection

• Relied on the use of publicly disclosed ASP.NET machine keys

Microsoft had earlier reported that this technique was being actively exploited in the wild. ConnectWise released ScreenConnect version 25.2.4 to address the flaw. However, it is unclear whether the newly reported breach is related to CVE-2025-3935.

Ongoing Monitoring and Remediation

Following the incident, ConnectWise has implemented the following defensive measures:

• Enhanced monitoring across its infrastructure

• Hardening of system configurations to prevent similar intrusions

• Continuous observation of customer environments

These measures indicate a proactive approach to containment and mitigation, but they also reflect the heightened threat level facing remote access software providers.

Historical Context: ScreenConnect Targeted in Prior Campaigns

This is not the first time that ScreenConnect has come under fire. In early 2024, two critical vulnerabilities—CVE-2024-1708 and CVE-2024-1709—were exploited in the wild. Those vulnerabilities enabled both cybercriminal groups and nation-state actors from China, North Korea, and Russia to deploy:

• Remote access trojans (RATs)

• Credential stealers

• Persistent malware strains

These incidents demonstrated how vulnerabilities in IT management tools can serve as entry points for high-impact cyberattacks.

Security Implications and Best Practices

Why This Matters

ScreenConnect and other RMM (Remote Monitoring and Management) tools are high-value targets due to:

• Their privileged access to customer systems

• Their central role in IT administration

• Their ability to execute code across multiple endpoints

If compromised, these tools can serve as multipliers for threat actors, enabling rapid propagation of ransomware, espionage tools, or data exfiltration campaigns.

Recommended Mitigations

To minimize exposure, organizations should:

• Update to the latest ScreenConnect version (25.2.4 or newer)

• Regularly monitor RMM activity logs for anomalies

• Apply least privilege principles to restrict RMM access

• Implement multi-factor authentication (MFA) for all administrative accounts

• Conduct routine vulnerability scans and penetration testing

Conclusion

The ConnectWise breach underscores the critical importance of securing remote access infrastructure, especially as nation-state actors continue to exploit such platforms for strategic advantage. While the full impact of this specific breach remains under investigation, it serves as a reminder that RMM tools must be treated as high-risk assets and protected accordingly.

ConnectWise’s response, including the enlistment of Google Mandiant and enhanced security monitoring, reflects an industry-standard approach. However, the broader cybersecurity community should remain alert, especially as threat actors continue to evolve their tactics.