ConnectWise
MITRE ATT&CK: S0591 View on attack.mitre.org
Aliases: ScreenConnect, ConnectWise
- First seen
- 2016-01-01 00:00:00
- Malware type
- rat
- Operating systems
- windows
- Related IoCs
- 1601 (1459 malicious)
- Last IoC activity
- 2026-10-18 00:36:41
- Profile updated
- 2026-07-07 12:52:16
Targeted industries: government-and-public-sector financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.
Recent IoC activity
1,459 malicious indicators in Maltiverse are attributed to ConnectWise (S0591). The 20 most recently updated:
Detection coverage
- 10 YARA rules
- 189 Sigma rules
Malware & tools used
- Video Capture (attack-pattern)
- PowerShell (attack-pattern)
- Screen Capture (attack-pattern)
Used by threat actors
- ScreenConnect Vulnerability Exploit Attacks (campaign)
- GOLD SOUTHFIELD (threat-actor)
- Scattered Spider (threat-actor)
- MuddyWater (threat-actor)
Detection rules
- SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs (yara-rule)
- SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 (yara-rule)
- SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 (yara-rule)
- SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 (yara-rule)
- SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 (yara-rule)
- SIGNATURE_BASE_MAL_CS_Loader_Feb24_1 (yara-rule)
- SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 (yara-rule)
- SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 (yara-rule)
- SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 (yara-rule)
- DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect_CERT (yara-rule)
Reports & references
- anomali.com — Probable Iranian Cyber Actors Static Kitten Conducting Cyberespionage Campaign Targeting Uae And Kuwait Government Agencies (report)
- Trend Micro — Earth Vetala Muddywater Continues To Target Organizations In T (report)
- MITRE ATT&CK — S0591 (report)