ConnectWise Control Remote Support Breach: AI-Driven Attack Exploits Zero‑Day RCE

What happened

A recent breach of ConnectWise Control, a widely deployed remote‑support platform, was traced to a sophisticated attack that leveraged an AI agent to orchestrate the compromise. Microsoft confirmed that the attacker employed an automated system to scan, exploit, and move laterally across victim networks.

Telemetry from Huntress shows the attack was carried out with a series of scripted tools that were steered by a human operator. The scripts targeted the remote‑support software’s zero‑day RCE flaw, allowing the attacker to execute arbitrary code on the host machine and gain persistence.

Who is affected

The primary victims are organizations that rely on ConnectWise Control for remote assistance, including managed service providers, IT support teams, and enterprises with legacy remote‑access solutions. Any deployment of the software that has not applied the latest security patch is at risk.

In addition to the direct compromise of the remote‑support agent, the attacker used the foothold to exfiltrate credentials, pivot into internal networks, and establish command‑and‑control channels. The attack was detected by Huntress after unusual outbound traffic and file‑system changes were observed on several customer endpoints.

Impact

The immediate impact includes unauthorized code execution on the host, potential data leakage, and the ability to spread laterally to other systems. The severity rating assigned by Microsoft is critical, and the exploit is considered a high‑risk vector for ransomware and data exfiltration.

Affected systems experienced a sudden increase in CPU usage, unexpected network connections to external IPs, and the creation of new scheduled tasks that persisted after reboot. The attacker also modified firewall rules to allow inbound traffic on non‑standard ports.

Exposure

Exposure is primarily through the remote‑support channel, which is often exposed to the internet for legitimate support purposes. Attackers can reach the software via the public endpoint, bypassing internal perimeter defenses if the software is not properly segmented.

The attack leveraged a zero‑day vulnerability in the ConnectWise Control 2.0 codebase that allowed remote code execution via a crafted payload. The vulnerability was not publicly disclosed at the time of the breach, making it a prime target for automated exploitation.

What to do

Defenders should immediately verify that all instances of ConnectWise Control are running the latest version, which includes the critical patch for the RCE flaw. If an upgrade is not possible, restrict inbound traffic to the remote‑support port and enforce strict authentication.

• Apply the official patch for ConnectWise Control 2.0 as soon as it becomes available.
• Disable or remove any unused remote‑support services from your network.
• Implement network segmentation to isolate remote‑support traffic from critical assets.
• Enable multi‑factor authentication for all remote‑support accounts.
• Deploy endpoint detection and response (EDR) to monitor for suspicious script execution.
• Block outbound connections to known malicious IP ranges identified by Huntress telemetry.

What to watch

Watch for signs that the attacker has pivoted into other systems, such as new scheduled tasks, unfamiliar user accounts, or changes to group policy objects. Monitor for repeated failed authentication attempts that may indicate credential stuffing or brute‑force attacks.

• Monitor logs for unusual outbound connections on ports 443 and 8443, commonly used by remote‑support software.
• Regularly audit firewall rules and ensure that only trusted IP ranges can reach the remote‑support endpoint.
• Stay vigilant and apply the latest patches to mitigate future exploitation.