Increased Abuse of ScreenConnect by Threat Actors in 2025

In 2025, there has been a significant rise in the abuse of ScreenConnect and other remote monitoring and management (RMM) tools by threat actors. Organizations using outdated or unpatched versions of these tools are particularly affected, as highlighted by reports from both Huntress and Barracuda Networks. The Huntress 2025 Cyber Threat Report noted that 17.3% of all threat incidents involved compromised ScreenConnect installations.