SCKit worm abuses ScreenConnect Run Command and RMM+ extension flaw to plant rogue clients on 288 endpoints in 48 organizations
Matéria consolidada. Reúne 8 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 8 fontes trouxeram em 12/11/2026 12:03; os links antigos trazem para cá.
Fontes: theregister.com ↗ itsecurityguru.org ↗ securityweek.com ↗ huntress.com ↗ gbhackers.com ↗ thehackernews.com ↗ securityonline.info ↗ bleepingcomputer.com ↗
A campaign observed on 11 November 2026 compromised ConnectWise ScreenConnect environments, including at least six MSPs, and used the Run Command feature to push rogue ScreenConnect clients and a worm-like toolkit called SCKit to at least 288 endpoints across 48 organizations (huntress.com, thehackernews.com, securityweek.com). Huntress discovered the activity; the 288 hosts were reportedly hit within about 90 minutes (securityweek.com, itsecurityguru.org). Huntress and several outlets tie the intrusion to an authentication flaw in the third-party RMM+ extension, versions 1.0.31 and 1.0.32, but the initial access vector is still officially under investigation. ConnectWise disabled five third-party extensions in roughly 400 partner environments as a precaution and says it has no evidence of a vulnerability in ScreenConnect itself or of a compromise of its infrastructure (theregister.com, thehackernews.com). Defenders should treat any partner running these extensions as potentially compromised and audit Run Command history even if no alert fired.
Entenda a falha
A vulnerabilidade
Huntress ties the attacks to an authentication flaw in RMM+, a third-party ScreenConnect extension. In versions 1.0.31 and 1.0.32 the access key defaults to blank, and if an admin never set one the extension accepts an empty key. A caller who can reach the extension's API can then run commands on managed endpoints, bypassing ScreenConnect accounts, roles and MFA. The attacks hit ScreenConnect 26.6.6.9747 and 26.7.6.9783; no fixed version is named, and ConnectWise disabled five extensions in about 400 environments. The articles give no CVE for this flaw. CVE-2026-84869, a critical file-transfer flaw patched earlier, is only context. ConnectWise has not confirmed the initial access vector, and Huntress also points to compromised credentials or hijacked sessions.
Como funciona
RMM+ lets other management tools send commands through ScreenConnect to managed machines without a technician using the console. A caller sends a request carrying a shared access key stored in the extension's settings, and the extension relays the command through ScreenConnect's remote command feature. It does not use ScreenConnect's normal user authentication. When no key was configured, the check does not reject an empty value, so the request passes and the command reaches the endpoints. Huntress saw commands reach machines in several instances within minutes, with no matching login activity.
Por que é vulnerável
The root cause is a missing check in the extension's authentication: the access key defaults to blank and the check does not reject an empty value. The design adds to the risk, because RMM+ deliberately bypasses ScreenConnect accounts, roles and MFA and relies only on that shared key. The setting's description tells admins to set a strong key, but nothing enforces it. The articles describe no code-level fix; ConnectWise's response was to disable the extensions and ask on-premises partners to do the same.
Onde está
The setting RMMPlus.AccessKey in the RMM+ extension's settings, whose default value is empty, as quoted in the Huntress write-up.
Como foi descoberta
Huntress's SOC spotted the campaign around 17:47 UTC on 11 November 2026, when rogue clients began appearing on endpoints of several ScreenConnect environments, and raised the alarm on Reddit. Later that day it linked the activity to RMM+, which ConnectWise had already disabled, and found the blank-key flaw in versions 1.0.31 and 1.0.32. ConnectWise published an advisory at 22:45 UTC naming five extensions and disabling them as a precaution; it had not found the initial access vector. Huntress told The Hacker News it saw no evidence of a new vulnerability and that telemetry pointed to compromised credentials or hijacked sessions. Sequential attacker tags suggest earlier, undetected MSP compromises.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article mentions a published PoC or exploit tool. What exists is exploitation in the wild: an operator pushed commands through ScreenConnect's Run Command to install rogue clients and the 16-file SCKit toolkit on at least 288 endpoints in 48 organizations within 90 minutes. SCKit also contains code meant to spread to technician workstations and other panels, but Huntress has not seen that succeed. This is a working, weaponized attack and no published copy is cited, so disabling the extensions and auditing Run Command history is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 12:18.
Detalhes técnicos
- Authentication flaw: in RMM+ 1.0.31 and 1.0.32 the access key could be left unconfigured and default to blank. This allowed unauthenticated remote command execution that bypassed user accounts, roles and MFA, with no login activity in the console (huntress.com, securityweek.com, theregister.com).
- Execution: the attacker used ScreenConnect's Run Command to run SYSTEM-level commands on managed endpoints and install persistent rogue clients (itsecurityguru.org, gbhackers.com).
- Payload: a base64-encoded dropper, an encrypted payload of per-host customized scripts and PowerShell scripts. The malware replaces legitimate ScreenConnect services to stay hidden (gbhackers.com, itsecurityguru.org). Some scripts appear to be LLM-generated (thehackernews.com).
- RelayTrap: the core SCKit component hijacks the legitimate client's relay connection to evade detection, disables the genuine client, and sets up persistence through scheduled tasks and security exclusions (itsecurityguru.org).
- Worm logic: code analysis shows intended lateral movement and console takeover by stealing technician session cookies through the panel's Shared Toolbox. Huntress says the cookie relay has not been successfully observed in live infections (huntress.com, itsecurityguru.org). Reinfection after host isolation has been observed (gbhackers.com).
- Technician workstation risk: an interactive session with an infected endpoint may compromise the technician's machine, although the exact method is unclear (bleepingcomputer.com). ConnectWise has not confirmed any such compromise (securityonline.info).
- Possible earlier activity: one rogue client ID was previously linked to months of malicious use, possibly tied to phishing. Its connection to the current attacks is unconfirmed (bleepingcomputer.com). Sequential identifiers suggest further undetected MSP compromises (bleepingcomputer.com).
- Indicators: Huntress published extensive IOCs, including IPs, domains and malware artifacts (huntress.com, thehackernews.com).
Remediação
- Disable RMM+ and the other affected third-party extensions, especially on on-premises ScreenConnect servers, as ConnectWise and Huntress advise (securityweek.com, huntress.com, securityonline.info).
- Audit Run Command and Shared Toolbox histories for anomalies, even if no alert fired (bleepingcomputer.com, itsecurityguru.org).
- Isolate affected hosts, revoke and reset credentials, rotate keys and enforce MFA (gbhackers.com, securityonline.info).
- Avoid interactive ScreenConnect sessions with suspected compromised devices so the malware does not reach technician workstations. Use alternative security tooling for investigation and removal rather than remote sessions over ScreenConnect (theregister.com, gbhackers.com).
- Follow the Huntress remediation guidance and apply its IOCs for hunting (huntress.com).
Relatos divergentes
- Scale: bleepingcomputer.com (earliest, 11 November) reported over 286 endpoints in 47 organizations and rising. Huntress (huntress.com) and later outlets report at least 288 endpoints in 48 organizations, which is the more recent and authoritative figure.
- Root cause: huntress.com, securityweek.com and theregister.com attribute the intrusion to the RMM+ blank-access-key flaw. bleepingcomputer.com points to compromised credentials and hijacked support sessions, securityonline.info says ConnectWise has not found the initial vector, and thehackernews.com says the vector is still under investigation. itsecurityguru.org describes abuse of the legitimate Run Command feature rather than direct exploitation. The RMM+ flaw is the best-supported explanation from the researcher source, but ConnectWise has not confirmed the vector.
- Deployment type: itsecurityguru.org says cloud-hosted panels were affected, while huntress.com and securityweek.com direct on-premises partners to disable the extensions. The sources do not reconcile these.
- Lateral movement: thehackernews.com says SCKit propagates between technician workstations and managed endpoints, and theregister.com says it attempts lateral movement. huntress.com, gbhackers.com and itsecurityguru.org say the session cookie relay was not successfully observed and no lateral movement to technician workstations was confirmed. The researcher view is more authoritative.
- ConnectWise position: several outlets stress that ConnectWise denies any compromise of its own software or infrastructure (thehackernews.com, gbhackers.com, theregister.com), while securityonline.info frames the disabling of extensions as a response to unauthorized partner account access.
Linha do tempo
-
Hackers Exploit Authentication Flaw in ScreenConnect Plugin to Deploy Malware on Hundreds of PCs
ler a análise desta fonte ocultar
An active hacking campaign exploited an authentication vulnerability in the RMM+ third-party extension for ScreenConnect, allowing attackers to bypass multifactor authentication and deploy a malware toolkit named SCKit on at least 288 machines across 48 organizations. The attackers leveraged the flaw to install rogue ScreenConnect clients that maintain persistent remote access and attempt lateral movement via infected IT technician workstations. ConnectWise, owner of ScreenConnect, disabled vulnerable extensions in approximately 400 environments but confirmed no evidence of a vulnerability in ScreenConnect itself or compromise of its infrastructure. The malware also tries to reinfect and spread within managed service provider (MSP) customer networks. Administrators are urged to avoid remote investigations over ScreenConnect and to use alternative security tools to remove the infections properly.
-
Rapid SCKit worm campaign abuses ScreenConnect Run Command to compromise 288 hosts in 90 minutes
ler a análise desta fonte ocultar
Researchers at Huntress uncovered a rapid and wide-reaching campaign where attackers exploited the legitimate Run Command feature in cloud-hosted ScreenConnect panels to silently install rogue ScreenConnect clients and a custom toolkit named SCKit across at least 288 hosts in around 90 minutes on November 11. The attackers used the Run Command capability to execute SYSTEM-level commands on managed endpoints rather than direct exploitation, installing a dropper and an encrypted payload of scripts customized per host. The core SCKit component, RelayTrap, hijacks the legitimate client's relay connection to evade detection, disables the genuine client, and establishes persistence mechanisms such as scheduled tasks and security exclusions. Although code analysis revealed worm-like capabilities intended to move laterally by stealing technician session cookies through the panel's Shared Toolbox, no successful lateral movement to technician workstations was confirmed. ConnectWise issued an advisory and disabled certain third-party extensions as a precaution. Defenders are advised to review Run Command and Toolbox histories for anomalies, isolate affected systems, rotate credentials, and follow recommended remediation steps. This incident highlights the risks posed by abuse of legitimate administrative features in remote management software.
-
Threat Actor Deploys SCKit Malware via Unauthorized Access to ConnectWise ScreenConnect Panels
ler a análise desta fonte ocultar
A new attack campaign observed on November 11 targeted ConnectWise ScreenConnect customers by exploiting a critical authentication bypass vulnerability in third-party RMM+ extensions. Attackers compromised at least 6 MSPs and 288 hosts across 48 organizations, deploying rogue ScreenConnect clients and a malware toolkit named SCKit that provides persistent backdoor access, session cookie interception, and self-replication capabilities. The initial intrusion exploited a flaw in RMM+ versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank, allowing unauthenticated remote command execution on managed endpoints. Incidents unfolded rapidly with 288 hosts compromised within 90 minutes. ConnectWise responded by disabling five RMM+ extensions across approximately 400 ScreenConnect environments. Huntress and ConnectWise recommend disabling these vulnerable extensions in on-premises ScreenConnect deployments to prevent further exploitation.
-
SCKit Worm Exploits ScreenConnect RMM+ Extension Authentication Flaw to Deploy Rogue Clients Across Hundreds of Endpoints
ler a análise desta fonte ocultar
On November 11, 2026, threat actors exploited a critical authentication flaw in the RMM+ third-party extension for ConnectWise ScreenConnect, allowing unauthorized mass deployment of rogue ScreenConnect clients and the SCKit toolkit across at least 288 endpoints in 48 organizations. The flaw in RMM+ versions 1.0.31 and 1.0.32 permitted blank access keys, bypassing user accounts, roles, and MFA, enabling the attacker to remotely execute commands via ScreenConnect consoles without login activity. The SCKit kit is a multi-component worm that spreads laterally and attempts console takeover and session cookie relay, although the latter has not been successfully observed in live infections. ConnectWise disabled RMM+ and related plugins and issued advisories urging on-premises partners to do the same. Huntress has provided extensive indicators of compromise and remediation guidance to help defenders detect and eradicate the infection. The attack chain relies on abusing ScreenConnect's Run command feature and installing persistent rogue clients to maintain control; compromised technician workstations pose additional risk if used to connect to infected endpoints, possibly spreading the worm further.
-
SCKit Worm Exploits ConnectWise ScreenConnect Panels, Infecting 288 Endpoints in 48 Organizations
ler a análise desta fonte ocultar
A worm toolkit named SCKit has compromised at least 288 managed endpoints across 48 organizations by exploiting abused ConnectWise ScreenConnect remote management panels. The attacker utilized the panels' Run command feature to deploy malicious installers that grant persistent SYSTEM-level access, install multiple malicious components including a base64-encoded dropper and PowerShell scripts, and replace legitimate ScreenConnect services to maintain stealth. The campaign is linked to vulnerabilities in third-party extensions disabled by ConnectWise and poor access key configuration in RMM+ versions 1.0.31 and 1.0.32, permitting bypass of accounts, roles, and multifactor authentication. While lateral movement attempts through session cookie theft failed in recovered logs, reinfection after isolation has been observed. ConnectWise continues to investigate the initial intrusion vector but denies compromise of its own infrastructure. Defenders are advised to isolate affected hosts, avoid interactive ScreenConnect sessions to prevent Malware spread to technicians’ workstations, revoke credentials, rotate keys, and audit command histories.
-
ScreenConnect Supply Chain Attacks Deploy Rogue Clients on 288 Endpoints Across 48 Organizations
ler a análise desta fonte ocultar
A wave of attacks leveraging compromised or hijacked ScreenConnect instances has led to the deployment of rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The attacker exploits third-party extensions and compromised credentials or sessions to gain access to ScreenConnect panels, then uses the Run Command feature to install a persistent backdoor toolkit named SCKit. This malware establishes remote access, steals authentication tokens, and propagates laterally between technician workstations and managed endpoints. ConnectWise, the vendor behind ScreenConnect, denies its infrastructure or software was compromised but has disabled five third-party extensions across partner environments as a precaution. Indicators of compromise include specific IPs, domains, and malware artifacts. The attack employs a worm-like two-step method involving initial rogue client deployment and lateral movement to technicians' machines, with some scripts apparently generated via large language models. The full scope and initial access vector remain under investigation.
-
ConnectWise Disables Five ScreenConnect Extensions After Unauthorized Partner Account Access
ler a análise desta fonte ocultar
On November 11, 2026, ConnectWise disabled five third-party ScreenConnect extensions in approximately 400 partner environments following unauthorized access to partner accounts. While ConnectWise has not named an attacker or discovered the initial access vector, the extensions are suspected to have played a role in enabling attackers to use ScreenConnect features to deploy other remote-access software within customer environments. There are reports of potential compromise of technician workstations during live sessions, but these remain unconfirmed by ConnectWise. Amidst this, the company urges all partners to disable these extensions if installed, reset credentials, enforce multi-factor authentication, and monitor logs to mitigate further risk. The breach risks affecting numerous customer networks managed by the compromised partners, making it critical to act promptly.
-
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ler a análise desta fonte ocultar
A malware campaign is actively targeting managed service providers (MSPs) by compromising ScreenConnect environments to deploy unauthorized remote-access clients to customer devices. Discovered by Huntress security firm, the attack has compromised six MSPs and affected over 286 endpoints across 47 organizations, with numbers rising. The attackers leverage ScreenConnect's Run Command to install rogue clients, enabling unauthorized remote access outside legitimate MSP control. A concerning technique also allows attackers to potentially compromise MSP technicians’ workstations during sessions with infected devices, although the precise method remains unclear. ConnectWise, the vendor behind ScreenConnect, is investigating and advises partners to avoid interactive sessions with suspected compromised devices, review activity logs, reset credentials, and enforce multifactor authentication. The attackers likely use compromised credentials and hijacked support sessions as initial access vectors, and sequential identifiers hint at additional undetected MSP compromises. Huntress shared multiple indicators of compromise and warns MSPs to audit their Run Command histories thoroughly even if unalerted. Previous activity linked to one rogue client ID suggests months-long malicious use, possibly tied to phishing campaigns, but the connection to current attacks remains unconfirmed.