Case file — Lead incident: Attackers are abusing compromised ScreenConnect environments to push rogue remote-access clients onto customer devices, in an active campaign discovered on November 11 by security firm Huntress. Six managed service providers (MSPs) are confirmed compromised so far, with 286 affected endpoints across 47 organizations — and Huntress says the numbers are still climbing. The attackers use the MSPs' own remote-access tooling against them, running commands through ScreenConnect to install unauthorized remote clients on customer machines. ConnectWise, which makes ScreenConnect, says it is investigating and has urged partners to avoid interactive remote sessions with potentially compromised devices. The campaign is live now, not a historical disclosure, and the victim count was rising within hours of discovery. Status: active campaign, investigation ongoing; no patch or CVE is involved — the abuse runs through legitimate remote-access features.
Incident timeline
| Date | Development |
|---|---|
| October 8–11, 2026 | Separate Qubole-related activity uses customer-owned AWS access keys for Qubole integrations; Wiz says it could not link this to the main supply-chain campaign. |
| October 14, 2026 | The Qubole-linked supply-chain campaign begins: compromised Qubole IAM credentials are used to assume customer integration roles in AWS, starting from a Mullvad VPN address. |
| October 18, 2026 | The Qubole attacker begins using a second IAM user from the same Qubole AWS account. |
| October 14–26, 2026 | Qubole campaign runs: secrets harvested and S3 data downloaded from multiple customer AWS environments. |
| November 9, 2026 | Wiz publishes its Qubole supply-chain investigation, conducted with Sentra and Mandiant. |
| November 10, 2026 | CISA adds the Cisco BroadWorks and Openwave flaws to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of November 24. AWS tells The Register its services were not compromised in the Qubole incident. |
| November 11, 2026 | Huntress discovers the active ScreenConnect campaign against MSPs (first activity around 17:47 UTC); Maersk confirms a breach at a legacy LF Logistics system; Baker Tilly begins notifying clients of a third-party provider breach; BleepingComputer reports the ScreenConnect and Baker Tilly incidents. |
1. Active ScreenConnect attacks breach MSPs, impact dozens of organizations
An active malware campaign is targeting managed service providers through their own ScreenConnect environments, and it is still unfolding. Cybersecurity firm Huntress discovered the campaign on Wednesday, November 11, and says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations, with the numbers continuing to rise. The campaign started around 17:47 UTC that day, according to Huntress's SOC, and targets cloud-hosted ScreenConnect instances.
ScreenConnect, made by ConnectWise, is a remote access and support platform MSPs and IT teams use to manage customer devices. The attackers compromise an MSP's ScreenConnect environment and then use its Run Command feature to deploy rogue remote-access clients onto customer devices — turning the provider's own management tool into the delivery mechanism. In a statement to BleepingComputer, ConnectWise confirmed it is investigating the attacks and urged partners to avoid interactive remote sessions with potentially compromised devices.
One artifact tied to the campaign is a script named SSA-2026-STATEMENT-15518787.bat, which appears to impersonate a Social Security Administration statement and was first uploaded to VirusTotal on July 25, 2026. Huntress has not named the threat actor behind the campaign, and the full scope is still being established as more MSPs check their environments.
Investigation notes
Why this is the lead: this is a live, still-growing campaign against the IT supply chain — the MSPs hit are the trusted administrators of dozens of downstream organizations. Six MSPs and 47 organizations is the count within hours of discovery, not a final tally.
What is confirmed: six compromised MSPs, 286+ affected endpoints, 47 organizations (Huntress, November 11); ConnectWise is investigating; the abuse runs through ScreenConnect's own remote-command capability.
What is not known: the threat actor, how the MSP environments were first compromised, and the final victim count. No CVE or patch applies — this is abuse of legitimate remote-access features, so the fix is containment, credential rotation, and hunting for rogue clients, not patching.
What MSPs and customers should do: ConnectWise's advice is to avoid interactive remote sessions with potentially compromised devices. Any organization whose MSP uses ScreenConnect should ask whether its environment has been checked, and hunt for unauthorized remote-access clients on endpoints.
2. Attackers abused Qubole's trusted AWS access to breach multiple customer cloud environments
A supply-chain attack abused trusted third-party access to break into multiple customer AWS environments and steal secrets and data. Cloud security company Wiz published its investigation on November 9, after data security firm Sentra spotted suspicious activity across several customer environments; Google's Mandiant joined the investigation. The attacker used compromised identity and access management (IAM) credentials associated with Qubole — a cloud data processing platform owned by Idera — to call sts:AssumeRole and obtain temporary credentials for customer-managed integration roles.
The activity ran from October 14 to October 26, 2026. The calls came from Qubole's AWS account 805246085872, using IAM user AIDA3W7DIFLYOLTK63SFS, and every AssumeRole request included an External ID — and every one succeeded. A second IAM user from the same account came into use on October 18. Once inside customer environments, the attacker enumerated storage, compute, database, identity, and key services, pulled secrets from Lambda environment variables, AWS Secrets Manager, and SSM Parameter Store, and downloaded data from accessible S3 buckets — in some cases entire buckets in a single session. Credentials found in the compromised environments, including AWS access keys, Microsoft Entra ID service principal credentials, and Okta OAuth client credentials, were then tested with TruffleHog, a secrets-scanning tool.
Wiz declined to say how many organizations were affected, calling it a "broad, opportunistic supply chain campaign" hitting "multiple" customer environments. Sentra, which first spotted the activity, said dozens of Qubole customers were affected, with millions of files stolen from one customer alone and more than 100 passwords and keys read within minutes. AWS told The Register that its services were not compromised and operated as designed — the attacker used credentials associated with a third-party provider to enter customer accounts through IAM roles those customers had configured to trust the provider. Qubole has not responded publicly. Wiz advises organizations that integrated with Qubole to review CloudTrail records from October 1, 2026, in every account holding an integration role.
Investigation notes
The trust that was abused: Qubole's platform works inside customer AWS accounts through cross-account IAM roles — the customer creates a role whose trust policy lets Qubole's AWS account assume it, typically gated by an External ID. The attacker did not need to break AWS; it used Qubole's own credentials against roles customers had already trusted. AWS notes the External ID is not a secret, so its presence in the attacker's requests is not, on its own, evidence of a leak.
What is confirmed: unauthorized role assumptions from Qubole's AWS account between October 14 and 26; secrets harvested from Lambda, Secrets Manager, and SSM; S3 data downloaded; credentials validated with TruffleHog. The campaign has not been attributed to a known threat group, and how the Qubole-associated credentials were obtained has not been disclosed.
The lingering-trust problem: researchers say the attacker exploited integrations that remained trusted even after some organizations had stopped using the platform. A retired vendor integration whose IAM role is never revoked is still a live door — review and remove stale cross-account trust relationships, not just active ones.
Detection gap: CloudTrail management events record the role assumption and bucket listing, but not object reads — so the AssumeRole calls themselves are the signal to hunt for, starting October 1, 2026.
3. Baker Tilly notifies clients of data breach at third-party provider
The Baker Tilly Advisory Group is notifying clients that a data breach has compromised personal information about them and their dependents. The exposed data was stored on a platform operated by a third-party service provider Baker Tilly uses to serve clients. Baker Tilly learned of the incident on September 6 and completed its review of the affected data on October 28, when it identified whose information was involved.
The notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder in the notice. But the Office of the Texas Attorney General's breach portal reports that 10,456 individuals in Texas alone were affected, with Social Security numbers, full names, addresses, and other information exposed. BleepingComputer found no announcements from ransomware groups claiming the attack, and no threat actor, CVE, malware, or network indicators have been published. BleepingComputer contacted Baker Tilly for more information about the breach, its source, the number of affected customers, and the type of data compromised, but had received no reply by the time of publishing.
Investigation notes
What is confirmed: a breach of client data held on an unnamed third-party provider's platform; discovery on September 6, review completed October 28; 10,456 affected Texas residents with SSNs, names, and addresses, per the Texas Attorney General's public portal.
What is not known: the identity of the third-party provider, the total number of affected clients (the Texas figure is one state's count only), the data types beyond what the Texas filing lists, the attacker, and the initial access vector.
The pattern: this is the second breach in this week's briefs where the compromised system belonged to someone else — a vendor, a provider, a platform. The data at risk (SSNs, names, addresses) is the raw material for identity theft, and the two-month gap between discovery and notification is a reminder that breach review timelines run long even when the incident itself is discovered quickly.
4. Maersk confirms data breach as WhiteArmor ransomware demands $5 million
A.P. Moller-Maersk confirmed on November 11 that a threat actor breached a system belonging to a company it acquired and stole data. The affected system was a local legacy system of LF Logistics, the warehousing and contract logistics business Maersk bought from Li & Fung in 2022. Maersk says the incident is isolated, its booking tools are working, and current findings "strongly suggest no sensitive data has been disclosed." It has not said how many people are affected, when the attacker first got in, what malware was used, or which data fields were taken.
The ransomware group WhiteArmor listed Maersk on its leak site over the weekend before the advisory, claiming about 100 GB of data from the former LF Logistics platform and demanding $5 million with a 30-day deadline for payment in bitcoin. Maersk did not name WhiteArmor in its advisory, so the group's claims remain unverified. Maersk's cybersecurity team found the problem, isolated the system, and opened a full investigation; the company says it found no sign of impact on other Maersk systems.
Investigation notes
Evidence rule, applied: the $5 million demand, the 100 GB figure, and the 30-day deadline are WhiteArmor's claims, reported by BleepingComputer — Maersk has confirmed only the unauthorized access and data extraction. The scale of what was taken is unclear: Maersk's own statement says current evidence strongly suggests no sensitive data has been disclosed, which sits in tension with the extortion claim. Report both, attribute each, and do not convert the group's claim into a confirmed victim count or a map pin beyond Maersk itself.
What is confirmed: unauthorized access and data extraction from one local legacy LF Logistics system; isolation and investigation underway; no impact found on other Maersk systems so far.
What is not known: the entry point, the timeline of the intrusion, the data taken, and whether WhiteArmor is the actor behind it. WhiteArmor also listed furniture retailer LoveSac in October, as reported earlier.
5. CISA adds exploited Cisco BroadWorks and Openwave flaws to KEV — patch deadline November 24
The U.S. Cybersecurity and Infrastructure Security Agency added two flaws in enterprise communications products to its Known Exploited Vulnerabilities (KEV) catalog on November 10, citing evidence of active exploitation. CVE-2026-20320 is an XML external entity (XXE) injection flaw in the Open Client Interface XML parser of Cisco BroadWorks, rated 7.5 (High), which lets an unauthenticated remote attacker read sensitive configuration information from the server filesystem through the OCI-P provisioning service on port 2208. CVE-2026-111793 is a file-type restriction bypass in Openwave Messaging Webtop Media Transcoder, rated 4.3, which lets an authenticated user process unintended document types by bypassing the webmail experience. Federal civilian agencies must remediate both by November 24, 2026.
Both flaws were already patched before the KEV listing — Cisco fixed the BroadWorks XXE on August 19, 2026, in release RI.2026.07, and Openwave shipped its transcoder fix in version 1.1.22.0. The BroadWorks flaw was documented by Malbear Labs on November 8 as the entry point in Operation Snowball, a two-week autonomous intrusion against a European telecommunications provider and 13 organizations hosted on its infrastructure, attributed to a Chinese-speaking actor using a jailbroken DeepSeek Flash AI model. Every vulnerability in that chain was already known — the agent chained existing flaws rather than finding new ones. CISA's KEV entries list known ransomware campaign use as unknown for both flaws.
Investigation notes
Official anchor: CISA's KEV additions of November 10, with a November 24 federal remediation deadline under Binding Operational Directive 22-01. The listing is the confirmation that exploitation is real; neither Cisco's advisory nor CISA's entry names the victims or the scale.
A discrepancy worth stating: sources disagree on when the Openwave fix shipped — one account dates version 1.1.22.0 to December 2021, another to October 2026. The version number is consistent; the date is not. Go by the version, and check the installed build rather than the calendar.
Why patched flaws still make the KEV list: a patch existing is not the same as a patch applied. Cisco knew of no attacks when it fixed the BroadWorks flaw in August; by November, CISA had evidence of active exploitation. Unpatched BroadWorks servers — the voice platform behind carriers' hosted PBX and collaboration services — remain exposed to unauthenticated file reads.
Detection angle: the BroadWorks flaw is unauthenticated XXE against the OCI-P service on port 2208. Watch for unusual XML parser requests and file-read patterns against that service, and confirm the installed BroadWorks release is RI.2026.07 or later.
Sources
- Active ScreenConnect attacks breach MSPs, impact dozens of organizations — BleepingComputer
- Attackers backdoor trusted AWS integrations to steal secrets — The Register
- Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials — SecurityIntelHub
- Baker Tilly notifies clients of data breach at third-party provider — BleepingComputer
- Maersk Data Breach: Legacy LF Logistics System (Nov 2026) — Checqo
- Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches — The Hacker News
