ConnectWise investigates reports of unauthorized access to ScreenConnect environments; Cloud Backup restoration proceeds in phases

ConnectWise is investigating reports of unauthorized access to certain partner ScreenConnect environments and deployment of unauthorized remote-access software in customer environments. ConnectWise has found no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect. Its initial assessment suggests that the activity may have involved abuse of independent third-party extensions installed in partner environments, but the initial access method and full scope remain under investigation. Approximately 400 partner environments were identified with at least one extension from the RMM+ family; the presence of the extensions alone does not establish compromise. ConnectWise also identified unauthorized access to application credentials associated with Cloud Backup, formerly known as SkyKick, and is restoring the service in phases.