```
Managed service providers running ConnectWise's ScreenConnect are being urged to patch their servers, rotate credentials and audit session logs immediately, after an active malware campaign compromised MSP environments and pushed rogue remote-access clients to customer devices across dozens of organisations.
ConnectWise is investigating the campaign, first reported by BleepingComputer, and has issued mitigations for affected and at-risk customers. Administrators should treat those mitigations as a same-day checklist rather than a weekend reading list.
What is happening. Attackers are breaching the management plane of MSP-run ScreenConnect servers, then abusing the product's own legitimate deployment and session capabilities to install unauthorised remote-access clients on downstream customer endpoints. In other words, the intrusion does not depend on an undisclosed zero-day being exploited in a chain against end users — it starts with a compromised administrator account or server, then uses trusted, signed functionality as the delivery mechanism. ConnectWise has said it is investigating; no full technical indicators of compromise (IOCs) have been published at the time of writing, and the investigation remains ongoing. Detection therefore has to be anomaly-based rather than signature-based.
Who is exposed. Any organisation operating an internet-facing ScreenConnect server — whether an MSP managing many tenants or an in-house team using it for internal support — is in scope. The attack surface is the management console itself.
What administrators should do today:
- Patch the ScreenConnect server to the current vendor-supplied build without waiting for a maintenance window.
- Rotate credentials for administrative accounts, database and integration keys, and any reused passwords.
- Audit session and connection logs for off-hours activity and unfamiliar source IPs, and inventory remote-access binaries on endpoints, flagging any ScreenConnect clients that IT did not deploy.
- Enforce MFA on all management-plane and privileged accounts where it is not already mandatory.
- Restrict the management plane: tighten unattended-access permissions so a stolen admin session cannot silently reach every endpoint, and place the console behind a VPN or zero-trust access layer rather than the public internet.
- Notify affected downstream customers promptly if their endpoints were touched.
Why this matters. This campaign illustrates what we would call the MSP-as-force-multiplier problem: compromising one management server reaches every customer that server manages, and the customer often has no independent signal that anything is wrong. The blast radius scales with the administrator's privileges, not the endpoint's. For a one-person IT team or a lean MSP, that asymmetry is the whole risk in one sentence.
Local considerations. For local MSPs and in-house administrators, the operational message is the checklist above; no locally affected organisations have been identified in the reporting so far, and none should be assumed. Organisations handling personal data should also check their obligations under the Personal Data (Privacy) Ordinance alongside any contractual notification commitments to clients — those contract duties may bite sooner than any regulatory deadline, so it is worth confirming them before, not during, an incident.
Bottom line: patch the server, rotate the keys, audit the logs — today, not next week.
```
使用 ConnectWise ScreenConnect 的管理服務供應商（MSP）被敦促立即修補伺服器、更換憑證及審計工作階段記錄，此前一場活躍的惡意軟件攻擊已入侵 MSP 環境，並向數十家機構的客戶設備推送未經授權的遠端存取用戶端。
ConnectWise 正就此次攻擊進行調查（首次由 BleepingComputer 報道），並已為受影響及有風險的客戶提供緩解措施。管理員應將這些緩解措施視為即日執行的清單，而非週末才閱讀的資料。
事件經過。 攻擊者入侵由 MSP 營運的 ScreenConnect 伺服器管理面（management plane），繼而濫用產品本身的合法部署及工作階段功能，在下游客戶端點安裝未經授權的遠端存取用戶端。換言之，入侵並非透過未公開的 zero-day 漏洞對最終用戶連環利用——而是先從被入侵的管理員帳戶或伺服器入手，再利用可信、已簽核的功能作為投放機制。ConnectWise 表示正進行調查；截至本文撰寫時尚未公布完整的入侵指標（IOC），調查仍在持續。因此偵測必須以異常行為為基礎，而非倚賴特徵碼（signature）。
受影響範圍。 任何營運對外開放的 ScreenConnect 伺服器的機構均屬範圍之內——不論是管理多個租戶的 MSP，還是用作內部支援的自設 IT 團隊。攻擊面就是管理主控台本身。
管理員今日應採取的行動：
- 立即修補 ScreenConnect 伺服器至供應商提供的最新版本，毋須等待維護時段。
- 更換憑證，包括管理員帳戶、數據庫及 integration keys，以及任何重複使用的密碼。
- 審計工作階段及連接記錄，查看非辦公時間活動及不熟悉的來源 IP，並盤點端點上的遠端存取執行檔，標記任何並非由 IT 部署的 ScreenConnect 用戶端。
- 強制啟用 MFA（多重身份驗證），適用於所有尚未強制要求的管理面及高權限帳戶。
- 限制管理面：收緊無人值守存取權限，令被盜取的管理員工作階段無法悄無聲息地存取所有端點，並將主控台置於 VPN 或 zero-trust 存取層之後，而非直接暴露於公開網絡。
- 及時通知受影響的下游客戶，如其端點已遭觸及。
事件重要性。 此次攻擊凸顯我們所稱的「MSP 作為攻擊力量倍增器」問題：入侵一部管理伺服器，即可觸及該伺服器管理的所有客戶，而客戶往往沒有任何獨立訊號察覺出現問題。爆炸半徑隨管理員權限而擴大，而非取決於端點本身。對於只有一人的 IT 團隊或規模精簡的 MSP 而言，這種不對稱性一句話已概括全部風險。
本地須注意事項。 對本地 MSP 及自設管理員而言，操作上的重點就是上述清單；迄今報道中未識別出任何本地受影響機構，但不應因此假設本地沒有風險。處理個人資料的機構，亦應在檢視對客戶的合約通知責任之餘，一併確認《個人資料（私隱）條例》下的義務——合約責任可能比任何法定時限更早觸發，因此應在事件發生前確認，而非事發期間才處理。
總結：修補伺服器、更換密鑰、審計記錄——就是今日，而非下週。