🧰 ConnectWise ScreenConnect

The items that name it 3

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  Remote access client (ScreenConnect.ClientService.exe, ScreenConnect.WindowsClient.exe) silently installed via downloaded ClientSetup.msi to create a secondary remote-access channel; software itself was not exploited, only abused after legitimate installation.

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeup2026-09-03

  affected by CVE-2026-84869 and used as the vector for rogue installations/worm-like spread

• Rogue RMMs: Common Social Engineering Tactics We Saw in 2025
  writeup2025-12-31

  RMM tool most frequently abused by threat actors via rogue installations disguised with social engineering lures; ConnectWise acknowledged on May 28 suspicious activity affecting 'a very small number of ScreenConnect customers'; makes up 74.5% of top abused remote access tools observed by Huntress.