Cybersecurity Breach at Connectwise Attributed to State-Sponsored Actors

Connectwise is facing significant challenges as it reports a security breach attributed to state-sponsored cybercriminals, affecting a select group of customers using its ScreenConnect remote support software.

The incident, which occurred on May 28, was characterized by the company as involving suspicious activities believed to be linked to an advanced persistent threat actor. In a recent security announcement, Connectwise confirmed that it detected these activities within its systems.

To thoroughly investigate the breach, Connectwise has enlisted the expertise of Mandiant, a subsidiary of Google specializing in IT forensics. The company has taken immediate action to inform all impacted customers and is collaborating with law enforcement agencies to address the situation. Enhanced monitoring measures and hardening protocols have been implemented across its IT infrastructure to mitigate future risks.

Following the installation of a security update in late April, Connectwise reported that no further suspicious activities have been observed in its cloud instances of ScreenConnect. The breach is believed to have stemmed from a vulnerability related to a ViewState code injection flaw (CVE-2025-3935 / EUVD-2025-12502), which has a high-risk rating of 8.1 on the CVSS scale.

While details regarding the specific impacts of the breach remain scarce, initial findings indicate that the incident was confined to the ScreenConnect platform, particularly its cloud instances. At this point, Connectwise has not confirmed whether the breach exploited the aforementioned security vulnerability. As a precaution, the company advises On-Premises installations to apply the April security updates promptly.

Connectwise is currently concentrating its efforts on identifying the affected partners and their systems while working to limit the consequences of this cyber attack. Notably, this incident does not appear to be a ransomware attack. Instead, the suspicious activities have been linked to a state-sponsored threat actor known for information-gathering operations.