Full Report
IT management software firm ConnectWise says a suspected state-sponsored cyberattack breached its environment and impacted a limited number of ScreenConnect customers. [...]
Analysis Summary
# Incident Report: ConnectWise ScreenConnect Compromise Linked to Nation-State Actors
## Executive Summary
ConnectWise experienced a cybersecurity incident affecting their cloud-based ScreenConnect platforms, which has been linked to nation-state threat actors. The attack vector strongly suggests the exploitation of a known, high-severity vulnerability, CVE-2025-3935, allowing for potential Remote Code Execution (RCE). While ConnectWise patched the flaw before public disclosure, the breach potentially allowed attackers to compromise their internal systems, steal machine keys, and subsequently target customer environments hosted on their cloud instances.
## Incident Details
- **Discovery Date:** Not explicitly stated in the provided text. Incident disclosure occurred following patching.
- **Incident Date:** Implied to have occurred prior to or around the patch date (April 24).
- **Affected Organization:** ConnectWise
- **Sector:** IT Management Software/Remote Monitoring and Management (RMM)
- **Geography:** Not explicitly stated, implied global due to cloud service offering.
## Timeline of Events
### Initial Access
- **Date/Time:** Prior to or around April 24 (patch date)
- **Vector:** Exploitation of **CVE-2025-3935** (ViewState code injection bug caused by unsafe deserialization of ASP.NET ViewState).
- **Details:** Attackers with system-level access may have stolen secret machine keys used by the ScreenConnect server.
### Lateral Movement
- **Details:** Attackers potentially used stolen machine keys to craft malicious payloads to achieve Remote Code Execution (RCE) on the ConnectWise ScreenConnect servers, potentially leading to access within customer environments.
### Data Exfiltration/Impact
- **Details:** The text confirms the breach of ConnectWise systems, impacting **cloud-based ScreenConnect instances**. The specific data stolen or damage caused to customers is not detailed, though the connection to nation-state actors suggests targeted espionage or disruption.
### Detection & Response
- **Details:** ConnectWise patched the critical vulnerability, CVE-2025-3935, on its cloud platforms (screenconnect[.]com and hostedrmm[.]com) on April 24. ConnectWise stated they saw no further suspicious activity in customer instances after patching.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2025-3935 (Unsafe deserialization leading to code injection).
- **Persistence:** Not detailed, but implied necessary to facilitate key theft and RCE.
- **Privilege Escalation:** Not detailed, but exploitation likely elevated access to a level where machine keys could be stolen.
- **Defense Evasion:** Not detailed.
- **Credential Access:** Stealing secret machine keys associated with the ScreenConnect server.
- **Discovery:** Not detailed.
- **Lateral Movement:** Using stolen machine keys to achieve Remote Code Execution (RCE) against ScreenConnect servers.
- **Collection:** Not detailed.
- **Exfiltration:** Not detailed, but implied as the ultimate goal of nation-state actors.
- **Impact:** Potential compromise of customer environments utilizing ConnectWise's cloud ScreenConnect.
## Impact Assessment
- **Financial:** Not available.
- **Data Breach:** Affected ConnectWise's cloud-hosted ScreenConnect instances. Specific customer data loss is unconfirmed by ConnectWise.
- **Operational:** Disruption related to the necessary emergency patching and incident response procedures. Limited impact reported on customer instances post-patch.
- **Reputational:** Significant due to the public nature of the breach and association with nation-state actors.
## Indicators of Compromise
- **Network indicators:** None specified (URLs/IPs defanged).
- **File indicators:** None specified.
- **Behavioral indicators:** Remote Code Execution (RCE) resulting from serialized ViewState manipulation.
## Response Actions
- **Containment:** Patching of CVE-2025-3935 across all cloud-hosted ScreenConnect platforms (screenconnect[.]com and hostedrmm[.]com) deployed on April 24.
- **Eradication:** Not detailed, but implied remediation following patching.
- **Recovery:** Stated that no further suspicious activity has been observed in customer instances.
## Lessons Learned
- The speed of patching a vulnerability (prior to public disclosure) can mitigate immediate, widespread exploitation.
- Reliance on third-party connection tools (like RMM platforms) presents a significant supply-chain risk, especially when exploited via critical vulnerabilities like unsafe deserialization.
- Nation-state actors are actively monitoring software vendors for zero-day or recent vulnerabilities susceptible to exploitation.
## Recommendations
- Organizations using ConnectWise ScreenConnect should rigorously verify that their self-hosted instances have been patched to versions resolving CVE-2025-3935 and all preceding security bulletins.
- Implement strong network segmentation between RMM infrastructure and sensitive corporate networks.
- Increase monitoring around known high-severity RCE vulnerabilities, especially immediately following vendor patches.