MITRE ATT&CKsoftware (tool)

S0591 ConnectWise

Published 2021-03-18 Modified 2025-10-13 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
ScreenConnect
Version
1.1
Created
2021-03-18

Description

ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.

Related

Uses · MITRE ATT&CK (3)

  • T1059.001 PowerShell sub-technique
  • T1113 Screen Capture technique
  • T1125 Video Capture technique

Referenced by MITRE ATT&CK · uses (3)

  • G1015 Scattered Spider group
  • G0115 GOLD SOUTHFIELD group
  • G0069 MuddyWater group

References