Huntress reported it yesterday: 6 MSPs breached, 286 endpoints hit, 47 downstream orgs.

The entry point wasn’t the ScreenConnect server. It was a customer endpoint — already authenticated to the MSP’s relay.

How it works:

Attacker gets SYSTEM on a customer endpoint

Reads the ScreenConnect agent’s local state: relay URL, deployment creds, session tokens, connection policies

Authenticates to the relay as that customer’s agent

Enumerates other sessions, potentially impersonates a technician, reaches every other customer

Why it’s invisible: The traffic looks like a legitimate session. The connection exists. The anomaly is the direction of the command — customer → MSP — which almost no monitoring stack flags.

No CVE. No patch. ScreenConnect is working as designed.…