ConnectWise ransomware attacks affecting Automate customers

ConnectWise customers are being targeted by ransomware attacks, though the software maker has provided little information about the threat.

The ConnectWise ransomware attacks are targeting customers using the Automate remote monitoring and management product on premises. The software maker, based in Tampa, Fla., which specializes in remote access software for managed service providers (MSPs), first disclosed on Twitter Thursday afternoon that it had received reports of ransomware attacks on its customers.

According to a company statement provided to SearchSecurity, malicious actors are "targeting open ports for ConnectWise Automate on-premises application to introduce ransomware."

"In an effort to protect our partners, we will not publicly disclose the specific port that is being targeted," the ConnectWise statement said. "We are communicating with our impacted Automate on-premise partners and are directing partners to reach out to the support team."

It is unclear when the attacks occurred, what type of ransomware was used, how many ConnectWise customers were targeted and if any of the ransomware attacks were successful.

A ConnectWise spokesperson confirmed the customers impacted by the ConnectWise ransomware attacks have been contacted via email and directed to a support page requiring a login. SearchSecurity was able to access the page, which is a ConnectWise University document titled, "ConnectWise Automate Installation Prerequisites." The page makes no reference to the current ransomware attacks against customers and provides no information about remediating the specific threat.

The company has not provided any additional public information about remediating the attacks beyond its initial tweet asking customers to "ensure that your ports are not left open to the internet."

However, customer replies to the ConnectWise tweet, including this information, suggest the support documentation and communication from the company are lacking needed details.

One reply from Anne Schoolcraft, president of A Couple of Gurus, an MSP based in Minneapolis, noted that she would have missed the information had it not been shared by someone else on LinkedIn.

Tom Scott, president of TS3 Technologies, a managed IT service company based in Birmingham, Ala., asked for more detail, including what ports are being targeted, and noted he had opened a support ticket with the same question.