Malware

ConnectWise

ConnectWise is a legitimate remote monitoring and management and remote access product that has been documented as being abused by threat actors as an intrusion-enabling tool rather than as traditional self-propagating malware. In adversary operations, it can provide remote interactive access to victim systems, support execution of PowerShell commands on target machines, and enable visual surveillance through screenshot and video capture on remote hosts. Because it is signed, commonly deployed in enterprise environments, and its network activity can resemble normal administrative traffic, malicious use can be difficult to distinguish from authorized IT activity. Reported abuse has included use by criminal operators seeking covert remote access and collection from compromised Windows environments. Its observed functionality in intrusion contexts aligns most closely with remote administration and post-compromise control, including command execution and on-host monitoring.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence4

ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints. ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations. ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.

Initial Access

1 technique

T1078.004Cloud AccountsEvidence1

credential-phishing serves as the initial-access vector, with a "technical interview" social-engineering pretext during which the operator drives an MFA-fatigue / SSPR-rotation sequence to seize Microsoft Entra ID accounts.

Execution

2 techniques

T1059.001PowerShellEvidence5

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

T1569.002Service ExecutionEvidence1

MITRE ATT&CK Mapping ... Execution System Services: Service Execution T1569.002 RMM agents install as system services

Persistence

2 techniques

T1078.004Cloud AccountsEvidence1

T1112Modify RegistryEvidence1

The Yanluowang threat actor enables the remote desktop service (RDP) from the registry and installs the ConnectWise tool for remote access.

Privilege Escalation

1 technique

T1078.004Cloud AccountsEvidence1

Stealth

2 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

MITRE ATT&CK Mapping ... Defense Evasion Masquerading: Match Legitimate Name or Location T1036.005 RMM binaries are legitimate vendor software

T1078.004Cloud AccountsEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The Yanluowang threat actor enables the remote desktop service (RDP) from the registry and installs the ConnectWise tool for remote access.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Atera: Capabilities: Remote desktop access, provided through Splashtop (default) or other supported RMM software Execute commands through PowerShell or command prompt terminal Gather system information

Lateral Movement

2 techniques

T1021Remote ServicesEvidence3

The content references repeated use of remote administration and remote execution tools such as PsExec, AnyDesk, Atera, ConnectWise, RemoteUtilities, SimpleHelp, PcShare, VNC, and commodity remote access tools.

T1021.001Remote Desktop ProtocolEvidence1

The Yanluowang threat actor enables the remote desktop service (RDP) from the registry and installs the ConnectWise tool for remote access.

Collection

2 techniques

T1113Screen CaptureEvidence3

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

T1125Video CaptureEvidence2

Agent Tesla can access the victim’s webcam and record video. AsyncRAT can record screen content on targeted systems. Bandook has modules that are capable of capturing video from a victim's webcam. ... ZxShell has a command to perform video device spying.

Command and Control

3 techniques

T1090.003Multi-hop ProxyEvidence1

MITRE ATT&CK Mapping ... Command and Control Proxy: Multi-hop Proxy T1090.003 ConnectWise cloud relays proxy through OVH backend servers

T1105Ingress Tool TransferEvidence1

RMM tools often enable file sharing between compromised machines and those of attackers, as well as the execution of arbitrary commands. These features empower attackers to easily drop and execute additional tools or malware, or exfiltrate data.

T1219Remote Access ToolsEvidence14

CrowdStrike said the OWASSRF exploit was used to drop remote access tools such as Plink and AnyDesk on Rackspace-compromised servers. BleepingComputer also found that Play ransomware tooling found online by researchers also contains the ConnectWise remote administration software, which will likely be deployed in attacks.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cofense blogNews

Dec 4, 2025

2026 Phishing Threat Predictions: 5 Key Takeaways

Legitimate remote access tool increasingly abused by attackers as a stealthy method for remote access and persistence, blending in with normal IT operations and evading detection.

mitre attack websiteNews

Oct 21, 2021

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Tool referenced as capable of executing PowerShell commands on target machines.

mitre attack websiteNews

Aug 4, 2020

GOLD SOUTHFIELD, Pinchy Spider, Group G0115 | MITRE ATT&CK®

The content lists ConnectWise as software associated with PowerShell execution, screen capture, and video capture capabilities.

mitre attack websiteNews

Nov 19, 2019

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Remote administration software that can execute PowerShell commands on target machines.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ConnectWise