ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat actors including MuddyWater and GOLD SOUTHFIELD to connect to and conduct lateral movement in target environments.[1][2]

ID: S0591
Associated Software: ScreenConnect
Type: TOOL
Platforms: Windows
Version: 1.0
Created: 18 March 2021
Last Modified: 13 April 2023

Associated Software Descriptions

Name Description


Techniques Used

Domain ID Name Use
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

ConnectWise can be used to execute PowerShell commands on target machines.[1]

Enterprise T1113 Screen Capture

ConnectWise can take screenshots on remote hosts.[1]

Enterprise T1125 Video Capture

ConnectWise can record video on remote hosts.[1]

Groups That Use This Software