ConnectWise Hit by Advanced Cyberattack: Internal Data at Risk

ConnectWise, a leading provider of IT management and remote access software, has confirmed a cyberattack attributed to a sophisticated nation-state actor.

The breach, discovered in May 2025, impacted a limited number of customers using the company’s ScreenConnect cloud platform, a tool widely used for remote support and system maintenance.

ConnectWise responded by engaging forensic experts from Mandiant, alerting affected customers, and coordinating with law enforcement.

The company asserts that enhanced monitoring and security hardening have since been implemented, and no further suspicious activity has been detected in customer environments.

The attack is believed to have exploited a critical vulnerability in ScreenConnect, tracked as CVE-2025-3935.

This high-severity flaw, rated CVSS 8.1, allowed attackers with privileged system-level access to execute remote code via ViewState code injection, leveraging unsafe deserialization in the ASP.NET framework.

While ConnectWise has not publicly confirmed the exact method of exploitation, security researchers and community reports suggest that the attackers may have stolen machine keys from the cloud infrastructure, enabling them to craft malicious payloads and gain unauthorized access.

ViewState Code Injection and Machine Key Abuse

The core of the vulnerability lies in the ASP.NET ViewState mechanism, which preserves page and control state between client and server.

ViewState data is encoded in Base64 and protected by machine keys—specifically, ValidationKey for message authentication code (MAC) generation and the DecryptionKey for encryption.

If these keys are compromised, an attacker can generate a malicious ViewState payload and send it to the server via a POST request.

Upon processing, the ASP.NET runtime decrypts and validates the payload, potentially executing arbitrary code in the server’s memory and granting the attacker remote code execution (RCE) capabilities.

Below is an example of how machine keys are defined in an ASP.NET configuration file:

xml<machineKey
  validationKey="A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X4Y5Z6A7B8C9D0E1F2"
  decryptionKey="1A2B3C4D5E6F7G8H9I0J1K2L3M4N5O6P7"
  validation="SHA1"
  decryption="AES"
/>

If attackers obtain these keys, they can use tools such as ysoserial.net to generate a malicious ViewState payload:

bashysoserial.exe -g ViewState -p TextFormattingRunProperties -c "calc.exe" --validationKey <ValidationKey> --decryptionKey <DecryptionKey>

This payload can then be submitted to a vulnerable endpoint, triggering code execution on the server.

Technical Term	Description
ViewState	ASP.NET mechanism for maintaining state between client and server, encoded and protected by keys.
Machine Key	Cryptographic keys (ValidationKey, DecryptionKey) used to secure ViewState data.
Remote Code Execution (RCE)	The ability for an attacker to run arbitrary code on a remote server.
CVE-2025-3935	The identifier for the ViewState code injection vulnerability in ScreenConnect.

Remediation Steps and Ongoing Risks

ConnectWise has released a critical security patch (version 25.2.4) to address the ViewState vulnerability.

All ScreenConnect cloud servers were updated proactively, while on-premises users are strongly urged to upgrade immediately following a specific upgrade path (22.8 → 23.3 → 25.2.4).

For those unable to upgrade to the latest version, free security patches are available for select older releases starting from 23.9.

The company also recommends enhanced monitoring for indicators of compromise (IoCs), such as unauthorized administrative accounts, suspicious commands, or webshell activity.

Security experts emphasize the importance of:

• Regularly updating software to the latest patched versions.
• Protecting and rotating machine keys.
• Monitoring for suspicious activity and unauthorized access.
• Educating staff to recognize phishing attempts, particularly those mimicking ScreenConnect login alerts.

The incident underscores the persistent threat posed by nation-state actors and the critical need for timely patching and robust security practices in remote access solutions.

As investigations continue, organizations using ScreenConnect are advised to remain vigilant and ensure all recommended security measures are in place.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!