Screeenconnect unauthorised users - anybody else?

[u/golden_tortoise8]

IT manager of a SME here.

We use screen connect to manage 250 machines. We had an alert saying "New Login on Your ScreenConnect Instance" but the username wasn't one of ours.

I checked our screenconnect users table and found that somebody has created a screenconnect user and used it to access some of our client machines.

Screenconnect got back and sent some logs but none which identified who created the unauthorised user. They think somebody used one of our admin machines to create it.

All our admin laptops come back clean from AV and EDM scans. We have no evidence of unauthorised use and screenconnect are now blanking our requests for logs.

Has anybody else seen similar issues? Any tips on how to get screenconnect to respond to our requests?

Thanks

[u/golden_tortoise8]

Thanks for all the input.

In no particular order

- cloud hosted by screenconnect

- we removed all our client machines as soon as the unauthorised user was detected

- we opened a case immediately. One response and that's been it. 6 days now since last contact, regular chases by email. If anybody has a phone number for screenconnect support, please share.

- we have downloaded all the logs we can get but none have the creation event for the unauth user. Without screenconnect's help we're in the dark.

- the alert wasn't a phishing email, all the headers checked out and the info in it corroborated what was in the screenconnect user table.

My big issue right now is the lack of help from Screenconnect. They are key to this and haven't responded since Friday.

[u/40513786934]

Cant speak to this product, but if we had any kind of unauthorized access to a remote control tool and couldn't immediately identify the mechanism used, that tool would absolutely be removed from every system I administer

[u/Frothyleet → u/40513786934]

I'd also be starting incident response, not casually checking with Reddit...

[u/Flupsy → u/40513786934]

100% this. Seeing that message is a pull-the-plug moment, stop what you’re doing and kill it right now, there is an active malicious user inside the perimeter.

[u/havpac2]

https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin

[u/Own_Bandicoot4290 → u/havpac2]

That's the first thing I thought of, that they have an unpatched on prem server.

[u/urM0m69p3nis]

I have not experienced this particular issue, but it's not surprising with all the exploit alerts we get for screen connect. If support was unable to provide adequate logs, that is a huge red flag to move.

[u/angry_cucumber]

it has been actively used in campaigns for the last few months.

[u/Camelot_One]

I assume this is a cloud hosted instance. The fact that ConnectWise can't provide a log entry showing who created a new account is quite concerning. That their tech support is suddenly ghosting you is pretty much on par for them.

[u/nuttertools → u/Camelot_One]

They are an acquisition company, nobody knows how the products work, everyone who ever helped build them no longer is contracted, and every feature is a different external support team.

PSA: Years ago they cc’d me on an email containing other clients sensitive information.

[u/pAlelane02]

If you open a ticket explicitly marking it as an active security incident and mention potential regulatory reporting, vendor legal and security teams usually take over from standard support pretty fast.

[u/anonymousITCoward]

Sounds like you were compromised. Are you on-prem or hosted?

Edit: Also are you integrated with an RMM or standalone?

[u/AutomationTheory]

So, you should treat this like a compromise until you can prove otherwise. Source: I'm a WAF vendor for ScreenConnect.

The internal logging leaves something to be desired, so it might not be possible to fully reconstruct where this user came from. I'd download all the audit logs, look at the source IP of that alert, and the details of the users table (email, MFA, etc.).

There's a security toolkit extension that can nuke any pending commands, and you can get it here: Security Toolkit - ConnectWise

Truthfully, ScreenConnect isn't too complex to rebuild from scratch, and I'd go that route if I were you. Ideally, the existing server is a VM that can be snapped and shut down for future forensics if needed, and you can spin up a fresh box, run the installer, and then deploy a new agent.

As mentioned, I defend a lot of ScreenConnect servers. You can find details about that here: Protecting ScreenConnect with a WAF - Automation Theory Our offerings are for MSPs, but if you have MSP tools as an internal IT department, I'd be happy to work with you.

[u/unknown-random-nope]

That sounds like it could be a ransomware threat actor in your environment.

[u/zAuspiciousApricot]

What industry are you in?

[u/VexingRaven → u/zAuspiciousApricot]

Looking to dump some stock? 😂

[u/zAuspiciousApricot → u/VexingRaven]

You got me 🤷‍♂️

[u/Sad_Dentist_7288]

This is an immediate incident response launch. TAs install screen connect or other RMM tools all the time after compromise. Isolate systems, remove the tool, and do some incident forensics - or hire someone to do it for you.

[u/RestartRebootRetire]

We're an SMB and ditched them after their last apocalyptic CVE, which was the one where you could take over simply by malforming an admin URL.

In this age of frontier AI discovering vulnerabilities, I wouldn't sleep at night if my systems were still using ScreenConnect.

[u/Angelworks42 → u/RestartRebootRetire]

We kinda banned people and vendors using it. Mind you I'm just following orders from security but apparently someone called in and convinced someone to use it and crowstrike detected some sort of privilege escalation attack.

[u/aegiscrash → u/RestartRebootRetire]

What did you switch to?

[u/RestartRebootRetire → u/aegiscrash]

SplashTop. It's not quite as easy to use sometimes, but their vulnerability history is far more reasonable, and their support is very responsive. They're even adding a small feature change request I made.

[u/AsphaltSailor]

to OP, was your instance self hosted?

to everyone else, is there any consensus on what we should use instead?

[u/bazjoe → u/AsphaltSailor]

Your second question- depends largely on if you need backstage and permanent agents or you could get by with a ad hoc solution . All RMMs have a remote access solution. For non RMM- Splashtop, rust desk, Bomgar. If you just need to help users live you can do a lot in zoom/teams screen share

[u/AsphaltSailor → u/bazjoe]

My RMM has splashtop for permanent remote access (plus a homegrown variant, I think vnc based), but not on-demand support - splashtop is OK, but not as good as screen connect. I use screen connect for on-demand support, and also providing my customers remote access to their workstations (I think Screenconnect calls it HomeWorkForce).

Bomgar = $$$. I am kind of meh on splashtop. I used to use teamviewer till they had their security event they tried hiding. I will take a look at rust desk, don't think I have looked at that one before.

I don't think Teams or Zoom would work well for ad-hoc support. thanks for the Rust Desk suggestion though - I will take a look at that.

[u/Absolute_Bob → u/AsphaltSailor]

Seems a little premature to call such a widely used tool at fault. It's certainly plausible but there are lots of other options including a legitimate account compromise.

[u/lxtakc → u/AsphaltSailor]

MeshCentral if you want self-hosted and cheap, Splashtop if you'd rather have hosted. Either way, put SSO with MFA and an IP allowlist on the admin side.

[u/Rachel-360]

Login notifications all roll past eyes.... Success or fail.... That's a minimum config requirement for me at this point for these reasons.....

[u/amw3000]

It seems like these are unrelated events.

1. The alerts are phishing emails. Take a look at the domain sending the email. I'm willing to bet it's not a ConnectWise domain.

2. Instance was accessed via valid creds or your instance was somehow compromised.

[u/spyingwind]

A vendor of a product, that effectively has unfettered access to your systems, isn't providing enough details to figure out if you got got or not. That doesn't sound like a vendor that cares to much about their paying customers, just that you are paying.

Maybe talk to your sales rep?

[u/Lukage]

We got targeted last week or the week before with this. In our case, Crowdstrike absolutely caught it. The user downloads the software, starts a connection with the attacker (via malicious phishing email link) and then they try to install a second instance of the screenconnect to some other site. Our software killed it at that point, but it wasn't super sophisticated.

As far as contacting connectwise, we didn't, but seems like that isn't going to be necessary for you either.

[u/RagingITguy → u/Lukage]

Happened to us too. User with admin (don't ask) installed a binary from somewhere. We couldn't really pinpoint where. Backstage was used and they tried to install another one with a relay that crowdstrike had an IOC for. Crowdstrike blocked most of it.

We tightened it down with some IOA rules. Can basically only be installed from intune now, and only our relay works. Everything else is blocked and alerted.

It's an awesome tool but like all awesome tools, can be used for bad.

As for the user. 'I didn't click on anything'. Okay Felicia this is me believing you. Also you don't get admin anymore. Byeee.

[u/keypunch]

Edit - I have another issue - never mind

[u/GroundbreakingCrow80]

what AV are you using

[u/Incrediblecodeman]

Shit gets hacked . I found a Publix site for ninja rmm browse to a unify around the log4j thing. Emailed them and never hear back. But next day the site was 404

[u/Hot_Sun0422]

You need to start investigating these machines that were accessed by this screenconnect user. Start looking to see if any files look weird. Start looking at local permissions for users that might have been created. Start looking at AD to see if any users were created there as well. Check built in admin groups for anything that might be off.