Hackers breach ConnectWise ScreenConnect environment, affecting multiple cloud customers
Take action: If you are running ConnectWise ScreenConnect, make sure to patch for CVE-2025-3935. It was already exploited to hack ConnectWise by nation-state hackers, so your own server will probably be targeted by the generic criminals now.
Learn More
Florida-based IT management software provider ConnectWise is reporting a cyberattack that breached its infrastructure and compromised a limited number of ScreenConnect customers.
The breach impacted cloud-hosted ScreenConnect instances, affecting what the company describes as "a very small number of ScreenConnect customers." The company has engaged Google Mandiant to conduct a forensic investigation and has coordinated with law enforcement agencies regarding the incident.
The attack appears to be linked to a high-severity vulnerability in ScreenConnect software:
- CVE-2025-3935 (CVSS score 8.1) - A ViewState code injection vulnerability affecting ScreenConnect versions 25.2.3 and earlier
The flaw is caused by unsafe deserialization of ASP.NET ViewState in ScreenConnect. Threat actors with privileged system-level access can steal the secret machine keys used by a ScreenConnect server and utilize them to craft malicious payloads that trigger remote code execution on the server. This vulnerability was patched by ConnectWise on April 24, 2025, before it was publicly disclosed to customers.
According to sources familiar with the investigation, the breach occurred in August 2024, but ConnectWise discovered the suspicious activity in May 2025. This means that the attackers maintained persistent access to ConnectWise's systems for approximately nine months.
The targeting appears to have been highly selective. Only a very small number of customers were impacted so the threat actor knew what they were looking for. This approach is characteristic of nation-state operations that prioritize specific intelligence targets.
Security researchers believe that threat actors first breached ConnectWise's systems and stole the machine keys. Using those keys, attackers could conduct remote code execution on the company's ScreenConnect servers and access customer environments.
ScreenConnect has a history of being targeted by advanced threat actors, particularly nation-state groups. Both China and Russia have been seen exploiting ConnectWise ScreenConnect vulnerabilities in the last two years. Previous incidents involving ScreenConnect vulnerabilities have resulted in widespread compromises, with researchers from Google saying in February that a hacker affiliated with China's Ministry of State Security exploited CVE-2024-1709 in ConnectWise ScreenConnect "to compromise hundreds of institutions primarily in the U.S. and Canada."
