SCKit Worm Exploits ConnectWise ScreenConnect Panels, Infecting 288 Endpoints in 48 Organizations
A worm toolkit named SCKit has compromised at least 288 managed endpoints across 48 organizations by exploiting abused ConnectWise ScreenConnect remote management panels. The attacker utilized the panels' Run command feature to deploy malicious installers that grant persistent SYSTEM-level access, install multiple malicious components including a base64-encoded dropper and PowerShell scripts, and replace legitimate ScreenConnect services to maintain stealth. The campaign is linked to vulnerabilities in third-party extensions disabled by ConnectWise and poor access key configuration in RMM+ versions 1.0.31 and 1.0.32, permitting bypass of accounts, roles, and multifactor authentication. While lateral movement attempts through session cookie theft failed in recovered logs, reinfection after isolation has been observed. ConnectWise continues to investigate the initial intrusion vector but denies compromise of its own infrastructure. Defenders are advised to isolate affected hosts, avoid interactive ScreenConnect sessions to prevent Malware spread to technicians’ workstations, revoke credentials, rotate keys, and audit command histories.
Linha do tempo
-
SCKit Worm Exploits ConnectWise ScreenConnect Panels, Infecting 288 Endpoints in 48 Organizations
ler a análise desta fonte ocultar
A worm toolkit named SCKit has compromised at least 288 managed endpoints across 48 organizations by exploiting abused ConnectWise ScreenConnect remote management panels. The attacker utilized the panels' Run command feature to deploy malicious installers that grant persistent SYSTEM-level access, install multiple malicious components including a base64-encoded dropper and PowerShell scripts, and replace legitimate ScreenConnect services to maintain stealth. The campaign is linked to vulnerabilities in third-party extensions disabled by ConnectWise and poor access key configuration in RMM+ versions 1.0.31 and 1.0.32, permitting bypass of accounts, roles, and multifactor authentication. While lateral movement attempts through session cookie theft failed in recovered logs, reinfection after isolation has been observed. ConnectWise continues to investigate the initial intrusion vector but denies compromise of its own infrastructure. Defenders are advised to isolate affected hosts, avoid interactive ScreenConnect sessions to prevent Malware spread to technicians’ workstations, revoke credentials, rotate keys, and audit command histories.