ScreenConnect security update: Guidance for partners

Protecting your business and your customers requires timely information and clear actions. As we investigate reports of unauthorized access to ScreenConnect partner accounts, please review these precautions and share them with your technical and security teams.

Our initial assessment suggests the activity may involve a threat actor’s abuse of independent third-party extensions installed in partner environments. The initial access method and full scope remain under investigation.

Review and disable the identified extensions

We identified approximately 400 partner environments with one or more of these extensions: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. Their presence alone does not establish compromise.

ConnectWise has disabled these extensions where we can take action. On-premises partners must disable them immediately. Verify they are disabled and do not re-enable or reinstall them pending further guidance. View extension removal instructions.

Disabling extensions alone may not remove unauthorized access already established on endpoints. If compromise is suspected, engage your security provider, isolate affected devices, and validate remediation before restoring connectivity. From a trusted device, revoke active ScreenConnect and associated identity-provider sessions and reset relevant credentials.

Stay on heightened alert

• Watch for unusual sign-ins, unfamiliar locations, repeated login failures, and unexpected MFA prompts.
• Investigate new administrator accounts or changes to user permissions.
• Review unexpected extension installations, remote commands, and Toolbox activity.
• Check for unapproved remote-access software on customer devices and technician workstations.
• Verify unexpected support requests, password-reset messages, and software downloads through a trusted channel.
• Confirm endpoint protection is running and investigate alerts promptly.
• Keep servers, technician clients, endpoint agents, operating systems, and browsers updated.
• Enforce MFA, use unique passwords, and remove unnecessary administrative access.
• Preserve suspicious activity logs and escalate concerns to your security team or provider.
• Avoid interactive ScreenConnect connections to suspected compromised devices; use separate security tooling to investigate.

Follow the ScreenConnect hardening guide and visit the ConnectWise Trust Center for current guidance and updates.