Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5806 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ScreenConnect Run Command Rogue Client Deployment (Splunk SPL) - Exploitation

Detects the core TL-2026-5806 behaviour: a ScreenConnect client service (the MSP Run Command channel) spawning cmd, PowerShell or msiexec to pull and install an attacker-controlled ScreenConnect client (ScreenConnect.ClientSetup.msi?...&c=Exploited<N>), run rogue client IDs 2588ef5c15954b10 / ed630cc2c873b091, or execute campaign scripts and domains. Abuses a trusted MSP relationship and valid MSP accounts; no CVE.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1199, T1078, T1219, T1072, T1059.001, T1059.003, T1105
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*\\ScreenConnect.ClientService.exe" OR ParentImage="*\\ScreenConnect.WindowsClient.exe") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\msiexec.exe")
| eval cmd=lower(CommandLine)
| where match(cmd,"screenconnect[.]clientsetup[.]msi|c=exploited|2588ef5c15954b10|ed630cc2c873b091|panel-lateral[.]ps1|runnew[.]cmd|run-lateral-full[.]bat|toolboxrelayuploader|mo7sen[.]dev|cdn007-digitaldownloads|payproofkit|amexsafekeyupdate|gotdns[.]org|homedns[.]org|(add|set)-mppreference|addmin")
| stats count as events min(_time) as first_seen max(_time) as last_seen values(Image) as child_process values(CommandLine) as command_lines by host, User, ParentImage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// TL-2026-5806 - ScreenConnect Run Command spawning shells/MSI installs with campaign indicators
let ScreenConnectParents = dynamic(["ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe"]);
let Shells = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "msiexec.exe"]);
let CampaignIndicators = dynamic(["ScreenConnect.ClientSetup.msi", "2588ef5c15954b10", "ed630cc2c873b091", "Panel-Lateral.ps1", "runnew.cmd", "Run-Lateral-Full.bat", "ToolboxRelayUploader", "mo7sen.dev", "cdn007-digitaldownloads.com", "payproofkit.com", "amexsafekeyupdate.com", "gotdns.org", "homedns.org", "Addmin"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (ScreenConnectParents)
| where FileName in~ (Shells)
| where ProcessCommandLine has_any (CampaignIndicators)
    or ProcessCommandLine matches regex @"(?i)c=Exploited[0-9]*"
    or ProcessCommandLine matches regex @"(?i)(Add|Set)-MpPreference.*-Exclusion"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by Timestamp desc

Sigma

title: ScreenConnect Run Command Deploying Rogue ScreenConnect Client or Attacker Scripts
id: 7c1e5a42-3b9d-4f6a-9e21-5d8a0b4c7e11
status: experimental
description: Detects a ScreenConnect client service process spawning cmd, PowerShell or msiexec with command lines carrying indicators of the TL-2026-5806 MSP campaign - ScreenConnect.ClientSetup.msi installer URLs tagged c=Exploited<N>, rogue client IDs 2588ef5c15954b10 / ed630cc2c873b091, attacker script names, campaign domains, Defender exclusions or the Addmin account.
references:
    - https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/
    - https://www.huntress.com/blog/rogue-screenconnect-installations
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1199
    - attack.t1078
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.t1072
    - attack.command-and-control
    - attack.t1219
    - attack.t1105
    - attack.tool.screenconnect
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\msiexec.exe'
    selection_cli:
        CommandLine|contains:
            - 'ScreenConnect.ClientSetup.msi'
            - 'c=Exploited'
            - '2588ef5c15954b10'
            - 'ed630cc2c873b091'
            - 'Panel-Lateral.ps1'
            - 'runnew.cmd'
            - 'Run-Lateral-Full.bat'
            - 'ToolboxRelayUploader'
            - 'mo7sen.dev'
            - 'cdn007-digitaldownloads.com'
            - 'payproofkit.com'
            - 'amexsafekeyupdate.com'
            - 'gotdns.org'
            - 'homedns.org'
            - 'Addmin'
    condition: all of selection_*
falsepositives:
    - A legitimate MSP using Run Command to install its own ScreenConnect client (allow-list your own instance ID and installer host)
    - Authorized remote support scripts that reference ScreenConnect.ClientSetup.msi
level: high

Known false positives:

• An MSP legitimately using Run Command to install its own ScreenConnect client or scripts referencing ScreenConnect.ClientSetup.msi
• Authorized remote-support or software-deployment tasks launched from the ScreenConnect service

Tuning notes: Allow-list your own MSP's ScreenConnect instance IDs and installer host; alert on any instance ID not on the approved list. Review historical Run Command entries for c=Exploited<N> tags (sequential numbering suggests earlier compromises). Extend the indicator list as Huntress/ConnectWise publish new IOCs.

• 🔒 ScreenConnect Run Command Rogue Client Deployment (Sentinel KQL) - Exploitation · unlock with TL Creds
• 🔒 ScreenConnect Campaign Persistence, Defender Exclusions and Addmin Account (Sentinel KQL) - Post-Exploitation · unlock with TL Creds
• 🔒 ScreenConnect Campaign C2 Infrastructure, Telegram Beacon and Lateral Tooling (Sentinel KQL) - C2 / Lateral Movement · unlock with TL Creds
• 🔒 ScreenConnect Run Command Rogue Client Deployment (Sigma) - Exploitation · unlock with TL Creds
• 🔒 ScreenConnect Campaign Persistence, Defender Exclusions and Addmin Account (Sigma) - Post-Exploitation · unlock with TL Creds
• 🔒 ScreenConnect Campaign C2 Infrastructure, Telegram Beacon and Lateral Tooling (Sigma) - C2 / Lateral Movement · unlock with TL Creds
• 🔒 ScreenConnect Campaign Persistence, Defender Exclusions and Addmin Account (Splunk SPL) - Post-Exploitation · unlock with TL Creds
• 🔒 ScreenConnect Campaign C2 Infrastructure, Telegram Beacon and Lateral Tooling (Splunk SPL) - C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-5806.

Sample indicators (3 of 18)

• IP address: 185.99.255[.]28
• Domain: newnewnew[.]gotdns[.]org
• File hash: 60142ea5daebbf94a2dec4009f673d9822a2fd796ac55478be1edea3136ef4bb

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

Technical analysis

Initial access is undetermined; telemetry points to compromised credentials and hijacked MSP support sessions.

On 2026-11-11 (campaign activity observed from roughly 17:47 UTC) Huntress began tracking attacks against cloud-hosted ScreenConnect instances operated by managed service providers (MSPs). Per BleepingComputer's report of Huntress findings, the attackers use ScreenConnect's legitimate Run Command feature from within the compromised MSP instance to install additional, attacker-controlled ScreenConnect clients on the MSP's managed customer endpoints. These rogue clients provide persistent remote access that sits outside the legitimate MSP's environment. At the time of reporting Huntress counted 6 compromised MSPs, 286+ endpoints and 47 affected organizations, and stated the numbers were still rising.

Huntress has not determined the initial access vector. Current telemetry points to compromised credentials and hijacked MSP support sessions. No CVE or vulnerability is cited in the source material, so this is tracked as abuse of legitimate remote-management functionality rather than exploitation of a named flaw. Installer URLs follow the pattern /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N> where <N> is a sequential tag; Huntress notes the sequential numbering suggests other MSPs may have been compromised earlier, and advises reviewing Run Command history (including older entries) even where no alert fired.

Observed attacker infrastructure includes a relay at 185.99.255.28 (hostname 'screen'), dynamic-DNS C2 domains newnewnew.gotdns.org and soxnewwork.homedns.org, a secondary C2 sc.payproofkit.com resolving to 155.94.150.39 (hostname WIN-FB5CKHMU4E1), a possible C2 at cdn007-digitaldownloads.com, and a stager URL on ns.mo7sen.dev. Two rogue ScreenConnect client IDs (2588ef5c15954b10, ed630cc2c873b091) and files named Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe and Run-Lateral-Full.bat were listed, and the attacker account name 'Addmin' was observed. The file names suggest lateral-movement tooling, but the source does not describe their function in detail.

Huntress also warned of a reverse-pivot risk: an attacker with a rogue client on a customer device could compromise an MSP technician's workstation when the technician opens an interactive session to the infected device. Whether this relies on a vulnerability or on legitimate functionality is not established.

Related but unconfirmed activity: a batch script 'SSA-2026-STATEMENT-15518787.bat' (first uploaded to VirusTotal 2026-07-25, impersonating a Social Security Administration statement) adds Microsoft Defender exclusions, persists via the Startup folder and Run key, retrieves install commands from amexsafekeyupdate.com, downloads ScreenConnect MSIs from cdn007-digitaldownloads.com and cyberrexdesign.screenconnect.com, checks for client ID ed630cc2c873b091 and reports success to the attackers via Telegram. The source states the link to the current campaign is unclear. Separately, Huntress documented a distinct worm-like rogue ScreenConnect campaign in August-September 2026; no link to this campaign has been established and its indicators are not included here.

ConnectWise says it is actively investigating, working with Huntress, and describes impact as a limited number of ScreenConnect partners. It advises partners to avoid interactive sessions with suspected compromised devices, review account activity, revoke active sessions, reset credentials from a trusted device and verify MFA is enforced, with further guidance promised via the ConnectWise Trust Center. No threat actor or malware family has been named. BeaconBeagle lookups for the two IPs could not be completed (HTTP 502 at research time).

MITRE ATT&CK techniques by tactic:

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship

Command and Control

T1219 Remote Access Tools

Persistence

T1547.001 Registry Run Keys / Startup Folder

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Review ScreenConnect Run Command history for unexpected deployments, including older entries, even without alerts
• Hunt for and block the listed IPs, domains, rogue client IDs (2588ef5c15954b10, ed630cc2c873b091) and file names
• Avoid interactive ScreenConnect sessions with suspected compromised devices; investigate them with separate tooling
• Revoke active sessions and reset credentials from a trusted device
• Verify MFA is enforced on all ScreenConnect and MSP accounts

Workarounds

• Restrict who can use Run Command in ScreenConnect roles and session groups
• Isolate endpoints with unrecognized ScreenConnect client IDs and rebuild if compromise is confirmed

Longer-term hardening

• Audit ScreenConnect instances for unauthorized client installers (e.g. installer URLs tagged c=Exploited<N>)
• Alert on new ScreenConnect client installs and instance IDs not on an approved list
• Monitor ConnectWise Trust Center for further guidance

Affected and fixed versions

• ConnectWise — ScreenConnect (cloud-hosted MSP instances)
  Vulnerable versions: Cloud-hosted instances of affected MSP partners; no specific version stated

Timeline

• 2026-07-25 Batch script locked-ioc-4 (SSA-statement lure) first uploaded to VirusTotal; it installs ScreenConnect and references rogue client ID ed630cc2c873b091. Link to the November campaign is unconfirmed.
• 2026-09-07 Huntress/press report a separate worm-like rogue ScreenConnect campaign; ConnectWise had not confirmed a link to any flaw, and no link to the MSP campaign is established.
• 2026-11-11 BleepingComputer publishes IOCs and guidance: review Run Command history, revoke sessions, reset credentials from a trusted device, verify MFA.
• 2026-11-11 ConnectWise confirms it is investigating with Huntress, says a limited number of partners are affected, and urges avoiding interactive sessions with suspected compromised devices.
• 2026-11-11 Huntress tracks 6 compromised MSPs, 286+ endpoints and 47 organizations, with counts still rising; its SOC is working the campaign.
• 2026-11-11 Huntress identifies the MSP campaign, with activity observed from roughly 17:47 UTC, abusing ScreenConnect Run Command to deploy rogue clients.

Sources cited

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity (Huntress) Huntress · Research
• ConnectWise Security Advisories connectwise.com · Vendor report
• VirusTotal: SSA-2026-STATEMENT-15518787.bat virustotal.com · Research · 2026-07-25
• Active ScreenConnect attacks breach MSPs, impact dozens of organizations (BleepingComputer) BleepingComputer · News · 2026-11-11
• Rogue ScreenConnect clients spread four-stage VBScript chain (The Hacker News) The Hacker News · News · 2026-09-07
• Attackers use rogue ScreenConnect clients to spread malware (Help Net Security) Help Net Security · News · 2026-09-07

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials
• AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages