A sophisticated cyberattack campaign has compromised hundreds of endpoints across dozens of managed service providers (MSPs) that use ConnectWise’s ScreenConnect remote monitoring and management (RMM) tool. The threat actor exploited a vulnerability in RMM+, a third-party extension, to gain unauthorized access to cloud-hosted ScreenConnect panels, allowing them to run malicious commands on connected endpoints.
The attackers’ goal was to deploy rogue ScreenConnect clients and a malware toolkit called SCKit, which provides persistent backdoor access and can self-replicate. What’s particularly concerning is that the campaign compromised at least six MSPs and 288 hosts across 48 organizations within just 90 minutes. The hackers likely exploited a bug in RMM+ versions 1.0.31 and 1.0.32, where the access key defaults to blank if not configured, allowing them to bypass authentication.
The malware toolkit SCKit works by initially infecting the technician’s workstation when they connect to the compromised endpoint. It then attempts to compromise other sessions the technician has access to and spread itself to other panels. While Huntress Labs’ analysis suggests that some functionality of SCKit may not be fully operational in all cases, the malware’s ability to provide persistent backdoor access and intercept session cookies is a significant concern.
ConnectWise has taken swift action by disabling five RMM+ extensions across approximately 400 ScreenConnect environments. However, the cybersecurity firm emphasizes that the presence of these extensions alone does not establish compromise. The extensions provide an API capable of executing remote commands, but access to this API is protected by a passphrase configured by the partner during setup.
Both Huntress and ConnectWise have released indicators of compromise (IoCs) associated with the campaign and recommend that organizations disable the affected RMM+ extensions in their on-premises ScreenConnect deployments. It’s essential for MSPs and their customers to stay vigilant and monitor their systems closely, as this attack campaign highlights the importance of robust security measures and regular software updates.
In light of this incident, it’s crucial for organizations using ScreenConnect or similar RMM tools to ensure they have a robust security posture in place. This includes regularly updating software, monitoring system activity, and implementing strong access controls. Additionally, MSPs should review their configuration settings and ensure that all third-party extensions are properly configured and up-to-date. By taking these precautions, organizations can minimize the risk of falling victim to similar cyberattacks in the future.
Source: SecurityWeek — 2026-11-12