ConnectWise — Malware Profile
ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.
MITRE ATT&CK techniques (3)
IntelFusions coverage
- Scattered Spider (UNC3944) 2025: Teleport as Novel C2 Persistence on AWS EC2, STONESTOP/POORTRY BYOVD EDR Termination, and DragonForce Ransomware Partnerships 2026-02-16
- Fake software sites hide a remote tool that drops AsyncRAT 2026-07-01
- Access broker exploits Citrix bug to plant DragonForce ransomware 2026-07-10