# Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations

> Huntress reports an active campaign in which attackers abuse ConnectWise ScreenConnect's Run Command on cloud-hosted MSP instances to push rogue ScreenConnect clients to customer endpoints. As of 2026-11-11 Huntress tracked 6 compromised MSPs, 286+ endpoints and 47 organizations, with counts still rising. Initial access is undetermined; telemetry points to compromised credentials and hijacked MSP support sessions.

- **Published:** 2026-11-11T23:53:54Z
- **Last reviewed:** 2026-11-11T23:53:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5806
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5806.png
- **ID:** TL-2026-5806
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)

## Description

On 2026-11-11 (campaign activity observed from roughly 17:47 UTC) Huntress began tracking attacks against cloud-hosted ScreenConnect instances operated by managed service providers (MSPs). Per BleepingComputer's report of Huntress findings, the attackers use ScreenConnect's legitimate Run Command feature from within the compromised MSP instance to install additional, attacker-controlled ScreenConnect clients on the MSP's managed customer endpoints. These rogue clients provide persistent remote access that sits outside the legitimate MSP's environment. At the time of reporting Huntress counted 6 compromised MSPs, 286+ endpoints and 47 affected organizations, and stated the numbers were still rising.

Huntress has not determined the initial access vector. Current telemetry points to compromised credentials and hijacked MSP support sessions. No CVE or vulnerability is cited in the source material, so this is tracked as abuse of legitimate remote-management functionality rather than exploitation of a named flaw. Installer URLs follow the pattern /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N> where <N> is a sequential tag; Huntress notes the sequential numbering suggests other MSPs may have been compromised earlier, and advises reviewing Run Command history (including older entries) even where no alert fired.

Observed attacker infrastructure includes a relay at 185.99.255.28 (hostname 'screen'), dynamic-DNS C2 domains newnewnew.gotdns.org and soxnewwork.homedns.org, a secondary C2 sc.payproofkit.com resolving to 155.94.150.39 (hostname WIN-FB5CKHMU4E1), a possible C2 at cdn007-digitaldownloads.com, and a stager URL on ns.mo7sen.dev. Two rogue ScreenConnect client IDs (2588ef5c15954b10, ed630cc2c873b091) and files named Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe and Run-Lateral-Full.bat were listed, and the attacker account name 'Addmin' was observed. The file names suggest lateral-movement tooling, but the source does not describe their function in detail.

Huntress also warned of a reverse-pivot risk: an attacker with a rogue client on a customer device could compromise an MSP technician's workstation when the technician opens an interactive session to the infected device. Whether this relies on a vulnerability or on legitimate functionality is not established.

Related but unconfirmed activity: a batch script 'SSA-2026-STATEMENT-15518787.bat' (first uploaded to VirusTotal 2026-07-25, impersonating a Social Security Administration statement) adds Microsoft Defender exclusions, persists via the Startup folder and Run key, retrieves install commands from amexsafekeyupdate.com, downloads ScreenConnect MSIs from cdn007-digitaldownloads.com and cyberrexdesign.screenconnect.com, checks for client ID ed630cc2c873b091 and reports success to the attackers via Telegram. The source states the link to the current campaign is unclear. Separately, Huntress documented a distinct worm-like rogue ScreenConnect campaign in August-September 2026; no link to this campaign has been established and its indicators are not included here.

ConnectWise says it is actively investigating, working with Huntress, and describes impact as a limited number of ScreenConnect partners. It advises partners to avoid interactive sessions with suspected compromised devices, review account activity, revoke active sessions, reset credentials from a trusted device and verify MFA is enforced, with further guidance promised via the ConnectWise Trust Center. No threat actor or malware family has been named. BeaconBeagle lookups for the two IPs could not be completed (HTTP 502 at research time).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1219 Remote Access Tools
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ScreenConnect Run Command Rogue Client Deployment (Splunk SPL) - Exploitation** (`TL-2026-5806-SPL-001`)

Detects the core TL-2026-5806 behaviour: a ScreenConnect client service (the MSP Run Command channel) spawning cmd, PowerShell or msiexec to pull and install an attacker-controlled ScreenConnect client (ScreenConnect.ClientSetup.msi?...&c=Exploited<N>), run rogue client IDs 2588ef5c15954b10 / ed630cc2c873b091, or execute campaign scripts and domains. Abuses a trusted MSP relationship and valid MSP accounts; no CVE.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1199, T1078, T1219, T1072, T1059.001, T1059.003, T1105
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*\\ScreenConnect.ClientService.exe" OR ParentImage="*\\ScreenConnect.WindowsClient.exe") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\msiexec.exe")
| eval cmd=lower(CommandLine)
| where match(cmd,"screenconnect[.]clientsetup[.]msi|c=exploited|2588ef5c15954b10|ed630cc2c873b091|panel-lateral[.]ps1|runnew[.]cmd|run-lateral-full[.]bat|toolboxrelayuploader|mo7sen[.]dev|cdn007-digitaldownloads|payproofkit|amexsafekeyupdate|gotdns[.]org|homedns[.]org|(add|set)-mppreference|addmin")
| stats count as events min(_time) as first_seen max(_time) as last_seen values(Image) as child_process values(CommandLine) as command_lines by host, User, ParentImage
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// TL-2026-5806 - ScreenConnect Run Command spawning shells/MSI installs with campaign indicators
let ScreenConnectParents = dynamic(["ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe"]);
let Shells = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "msiexec.exe"]);
let CampaignIndicators = dynamic(["ScreenConnect.ClientSetup.msi", "2588ef5c15954b10", "ed630cc2c873b091", "Panel-Lateral.ps1", "runnew.cmd", "Run-Lateral-Full.bat", "ToolboxRelayUploader", "mo7sen.dev", "cdn007-digitaldownloads.com", "payproofkit.com", "amexsafekeyupdate.com", "gotdns.org", "homedns.org", "Addmin"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (ScreenConnectParents)
| where FileName in~ (Shells)
| where ProcessCommandLine has_any (CampaignIndicators)
    or ProcessCommandLine matches regex @"(?i)c=Exploited[0-9]*"
    or ProcessCommandLine matches regex @"(?i)(Add|Set)-MpPreference.*-Exclusion"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by Timestamp desc
```

### Sigma

```yaml
title: ScreenConnect Run Command Deploying Rogue ScreenConnect Client or Attacker Scripts
id: 7c1e5a42-3b9d-4f6a-9e21-5d8a0b4c7e11
status: experimental
description: Detects a ScreenConnect client service process spawning cmd, PowerShell or msiexec with command lines carrying indicators of the TL-2026-5806 MSP campaign - ScreenConnect.ClientSetup.msi installer URLs tagged c=Exploited<N>, rogue client IDs 2588ef5c15954b10 / ed630cc2c873b091, attacker script names, campaign domains, Defender exclusions or the Addmin account.
references:
    - https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/
    - https://www.huntress.com/blog/rogue-screenconnect-installations
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1199
    - attack.t1078
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.t1072
    - attack.command-and-control
    - attack.t1219
    - attack.t1105
    - attack.tool.screenconnect
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\msiexec.exe'
    selection_cli:
        CommandLine|contains:
            - 'ScreenConnect.ClientSetup.msi'
            - 'c=Exploited'
            - '2588ef5c15954b10'
            - 'ed630cc2c873b091'
            - 'Panel-Lateral.ps1'
            - 'runnew.cmd'
            - 'Run-Lateral-Full.bat'
            - 'ToolboxRelayUploader'
            - 'mo7sen.dev'
            - 'cdn007-digitaldownloads.com'
            - 'payproofkit.com'
            - 'amexsafekeyupdate.com'
            - 'gotdns.org'
            - 'homedns.org'
            - 'Addmin'
    condition: all of selection_*
falsepositives:
    - A legitimate MSP using Run Command to install its own ScreenConnect client (allow-list your own instance ID and installer host)
    - Authorized remote support scripts that reference ScreenConnect.ClientSetup.msi
level: high
```

**Known false positives:**

- An MSP legitimately using Run Command to install its own ScreenConnect client or scripts referencing ScreenConnect.ClientSetup.msi
- Authorized remote-support or software-deployment tasks launched from the ScreenConnect service

**Tuning notes:** Allow-list your own MSP's ScreenConnect instance IDs and installer host; alert on any instance ID not on the approved list. Review historical Run Command entries for c=Exploited<N> tags (sequential numbering suggests earlier compromises). Extend the indicator list as Huntress/ConnectWise publish new IOCs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ScreenConnect Run Command Rogue Client Deployment (Sentinel KQL) - Exploitation (locked: unlock with TL Creds)
- ScreenConnect Campaign Persistence, Defender Exclusions and Addmin Account (Sentinel KQL) - Post-Exploitation (locked: unlock with TL Creds)
- ScreenConnect Campaign C2 Infrastructure, Telegram Beacon and Lateral Tooling (Sentinel KQL) - C2 / Lateral Movement (locked: unlock with TL Creds)
- ScreenConnect Run Command Rogue Client Deployment (Sigma) - Exploitation (locked: unlock with TL Creds)
- ScreenConnect Campaign Persistence, Defender Exclusions and Addmin Account (Sigma) - Post-Exploitation (locked: unlock with TL Creds)
- ScreenConnect Campaign C2 Infrastructure, Telegram Beacon and Lateral Tooling (Sigma) - C2 / Lateral Movement (locked: unlock with TL Creds)
- ScreenConnect Campaign Persistence, Defender Exclusions and Addmin Account (Splunk SPL) - Post-Exploitation (locked: unlock with TL Creds)
- ScreenConnect Campaign C2 Infrastructure, Telegram Beacon and Lateral Tooling (Splunk SPL) - C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `185.99.255[.]28`
- Domain: `newnewnew[.]gotdns[.]org`
- File hash: `60142ea5daebbf94a2dec4009f673d9822a2fd796ac55478be1edea3136ef4bb`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Active ScreenConnect attacks breach MSPs, impact dozens of organizations (BleepingComputer)](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/)
- [Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity (Huntress)](https://www.huntress.com/blog/rogue-screenconnect-installations)
- [Rogue ScreenConnect clients spread four-stage VBScript chain (The Hacker News)](https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html)
- [Attackers use rogue ScreenConnect clients to spread malware (Help Net Security)](https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/)
- [ConnectWise Security Advisories](https://www.connectwise.com/company/trust/advisories)
- [VirusTotal: SSA-2026-STATEMENT-15518787.bat](https://www.virustotal.com/gui/file/60142ea5daebbf94a2dec4009f673d9822a2fd796ac55478be1edea3136ef4bb/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5806