The global cyber war · Companies and supply chains

ConnectWise investigates malicious activity affecting ScreenConnect partners; Huntress tracks dozens of hit organisations

Reported2 distinct origins, 0 independent.

ConnectWise said on 11 November that it was investigating malicious activity affecting a limited number of partners of its ScreenConnect remote-support service, BleepingComputer reported. Huntress, a security company that examined the activity, said it began at about 17:47 UTC that day and affected cloud-hosted ScreenConnect instances, and that it was tracking six compromised managed service providers and more than 286 endpoints across 47 organisations, with numbers rising, BleepingComputer reported. None of the providers or organisations was named. Nobody has named an actor.

When
11 November 2026
Where
No fixed place, No single country
What
cyber, software supplier
Attribution
Not attributed. No government, court or company has said who did it.
In the record
Published 2026-11-12 01:51 UTC

Sources

  1. Evidence BleepingComputer Media · Not yet classified origin: ConnectWise statement, 11 Nov · published 2026-11-11 00:00 UTC
  2. Corroboration BleepingComputer Media · Not yet classified origin: Huntress analysis, 11 Nov · published 2026-11-11 00:00 UTC

History

Cite or reuse

The War Record, "ConnectWise investigates malicious activity affecting ScreenConnect partners; Huntress tracks dozens of hit organisations", record ev-20261112-f6hh, version 1, https://thewarrecord.com/events/ev-20261112-f6hh/

This month's events as JSON (id ev-20261112-f6hh) · CC BY 4.0