Threat Actor Deploys SCKit Malware via Unauthorized Access to ConnectWise ScreenConnect Panels
A new attack campaign observed on November 11 targeted ConnectWise ScreenConnect customers by exploiting a critical authentication bypass vulnerability in third-party RMM+ extensions. Attackers compromised at least 6 MSPs and 288 hosts across 48 organizations, deploying rogue ScreenConnect clients and a malware toolkit named SCKit that provides persistent backdoor access, session cookie interception, and self-replication capabilities. The initial intrusion exploited a flaw in RMM+ versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank, allowing unauthenticated remote command execution on managed endpoints. Incidents unfolded rapidly with 288 hosts compromised within 90 minutes. ConnectWise responded by disabling five RMM+ extensions across approximately 400 ScreenConnect environments. Huntress and ConnectWise recommend disabling these vulnerable extensions in on-premises ScreenConnect deployments to prevent further exploitation.
Entenda a falha
A vulnerabilidade
No CVE is listed. The flaw is an authentication bypass in RMM+, a third-party ScreenConnect extension for managing sessions, in versions 1.0.31 and 1.0.32. The extension uses a shared access key to bypass ScreenConnect's own authentication, and if an administrator never configured the key, it accepts a blank one. An attacker needs no credentials, only network reach to the exposed extension API, and can then run remote commands on managed endpoints. Huntress says the attackers 'likely' exploited this bug. The articles name no fixed version. ConnectWise disabled five RMM+ family extensions across about 400 environments, and both vendors advise disabling them on on-premises deployments.
Como funciona
RMM+ exposes an API that can execute remote commands on endpoints managed through ScreenConnect. Access to that API is meant to be protected by a passphrase the partner sets during setup. A request reaches the extension carrying the access key, and the extension checks it before passing the command on to the managed endpoint. In versions 1.0.31 and 1.0.32 with no key configured, the blank value is accepted as valid, so the command is relayed without any ScreenConnect login. Huntress saw commands reach endpoints within minutes with no matching login activity, only RMM+ log entries.
Por que é vulnerável
The root cause is an insecure default combined with a missing check: when the access key is not configured, the extension treats it as blank and accepts a blank value instead of refusing to work until a key is set. Huntress notes that many installations were legitimate, added for a project and left in place, so the key was never set and the exposure went unnoticed. The articles do not describe how a fix changes the code.
Como foi descoberta
The flaw came to light through incident response: Huntress investigated attacks seen on November 11 against ScreenConnect customers and traced the commands to RMM+ rather than to logins. It found the campaign hit at least 6 MSPs and 288 hosts across 48 organizations, all within 90 minutes. ConnectWise then disabled five RMM+ family extensions in about 400 environments, and both companies published indicators of compromise. The articles do not mention an earlier report of the weakness.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No public proof of concept is mentioned. The flaw was exploited in real attacks that ran commands on endpoints and deployed rogue ScreenConnect clients and the SCKit toolkit, but no published exploit copy is cited. Given active exploitation, treat exposed RMM+ 1.0.31 and 1.0.32 installations as urgent: disable the extensions and review them against the published IoCs.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 09:15.
Linha do tempo
-
Threat Actor Deploys SCKit Malware via Unauthorized Access to ConnectWise ScreenConnect Panels
ler a análise desta fonte ocultar
A new attack campaign observed on November 11 targeted ConnectWise ScreenConnect customers by exploiting a critical authentication bypass vulnerability in third-party RMM+ extensions. Attackers compromised at least 6 MSPs and 288 hosts across 48 organizations, deploying rogue ScreenConnect clients and a malware toolkit named SCKit that provides persistent backdoor access, session cookie interception, and self-replication capabilities. The initial intrusion exploited a flaw in RMM+ versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank, allowing unauthenticated remote command execution on managed endpoints. Incidents unfolded rapidly with 288 hosts compromised within 90 minutes. ConnectWise responded by disabling five RMM+ extensions across approximately 400 ScreenConnect environments. Huntress and ConnectWise recommend disabling these vulnerable extensions in on-premises ScreenConnect deployments to prevent further exploitation.