ConnectWise — Malware Profile
ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.
MITRE ATT&CK techniques (3)
IntelFusions coverage
- Scattered Spider (UNC3944) 2025: Teleport as Novel C2 Persistence on AWS EC2, STONESTOP/POORTRY BYOVD EDR Termination, and DragonForce Ransomware Partnerships 2026-02-16
- Fake software sites hide a remote tool that drops AsyncRAT 2026-07-01
- Access broker exploits Citrix bug to plant DragonForce ransomware 2026-07-10
- Extortion crew claims data theft at Coca-Cola's Fairlife dairy arm 2026-07-29
- CISA gives agencies three days to patch ScreenConnect 2026-09-12
- CISA says a Cisco email gateway bug is under attack 2026-09-14
- Ransomware victim counts jumped by a third in early 2026 2026-09-16
- Cisco's access gatekeeper is being bypassed in attacks 2026-09-16
- Fake tax bonus site copies Italy's SPID login screen 2026-09-18
- One ransomware affiliate, four brands, the same toolkit 2026-09-25
- Fake APT36 ransomware locks screens but encrypts nothing 2026-09-29
- Phishing lures install two IT admin tools for backup access 2026-09-30
- Stolen ConnectWise backup credential opens 162 M365 tenants 2026-10-17
- FBI and CISA warn SafePay ransomware has hit 600 victims 2026-10-20
- China-aligned hackers used AI agents in ConnectWise breach 2026-10-21
- AI agent tied to China's Storm-0940 hits software vendors 2026-10-22