Description
ConnectWise is a legitimate remote management and monitoring platform that IT departments use to administer client systems, and cyberattackers abuse it to maintain unauthorized access. Because the vendor signs the software and enterprises commonly deploy it, intrusions that rely on it often blend in with routine administrative activity. Threat actors have delivered it through phishing and software flaws, and defenders should alert on unexpected ConnectWise installations and connections.
Stats
- First seen
- March 2022
- Last seen
- August 2026
Also known as
ConnectwiseScreenConnectScreenConnectTool
MITRE ATT&CK techniques
3 techniques across 2 tactics.
Associated groups
Alert name variants
| Alert Name |
|---|
| Binary.Malware.ConnectWise |
| Binary.Malware.ScreenConnect |
| ByteCode-MSIL.Trojan.ScreenConnect |
| Win32.Exploit.ScreenConnectTool |
| Win32.Infostealer.ScreenConnectTool |
| Win32.PUA.Connectwise |
| Win32.Ransomware.ScreenConnectTool |
| Win32.Spyware.ConnectWise |
| Win32.Trojan.ConnectWise |
| Win32.Trojan.ScreenConnectTool |
