ConnectWise says nation-state attack targeted multiple ScreenConnect customers

ConnectWise disclosed an investigation into a sophisticated nation-state attack that affected a small number of ScreenConnect customers; the company engaged Mandiant, applied patches and enhanced monitoring, and reported no further suspicious activity. The report links exploitation of CVE-2024-1709 and notes prior use of ScreenConnect vulnerabilities by China-affiliated actors and Russia-linked Sandworm against governments, defense contractors and other organizations, highlighting elevated supply-chain and MSP-related risk.