SCKit Worm Exploits ScreenConnect RMM+ Extension Authentication Flaw to Deploy Rogue Clients Across Hundreds of Endpoints
On November 11, 2026, threat actors exploited a critical authentication flaw in the RMM+ third-party extension for ConnectWise ScreenConnect, allowing unauthorized mass deployment of rogue ScreenConnect clients and the SCKit toolkit across at least 288 endpoints in 48 organizations. The flaw in RMM+ versions 1.0.31 and 1.0.32 permitted blank access keys, bypassing user accounts, roles, and MFA, enabling the attacker to remotely execute commands via ScreenConnect consoles without login activity. The SCKit kit is a multi-component worm that spreads laterally and attempts console takeover and session cookie relay, although the latter has not been successfully observed in live infections. ConnectWise disabled RMM+ and related plugins and issued advisories urging on-premises partners to do the same. Huntress has provided extensive indicators of compromise and remediation guidance to help defenders detect and eradicate the infection. The attack chain relies on abusing ScreenConnect's Run command feature and installing persistent rogue clients to maintain control; compromised technician workstations pose additional risk if used to connect to infected endpoints, possibly spreading the worm further.
Entenda a falha
A vulnerabilidade
The RMM+ third-party extension for ConnectWise ScreenConnect, versions 1.0.31 and 1.0.32, has an authentication flaw. RMM+ skips ScreenConnect user accounts, roles and MFA and relies on a shared access key; in these versions the key defaults to blank and the check accepts an empty value if the admin never set one. An attacker who can reach the server can then send commands to managed endpoints with no login. Huntress saw this used to deploy rogue ScreenConnect clients and the SCKit toolkit on at least 288 hosts in 48 organizations. The story lists CVE-2026-84869, but the Huntress article ties that ID to a separate September 2026 ConnectWise file-transfer flaw (CVSS 9.9), not to RMM+. The article gives no CVE and no fixed version for RMM+; ConnectWise disabled the extension instead.
Como funciona
RMM+ lets another tool manage ScreenConnect sessions without a technician working in the console. It receives POST requests and is supposed to compare the access key in the request with the one stored in the extension's settings. When the admin never configured the key, the stored value is empty, and the check does not reject an empty value, so the request passes and the extension's functions run. Huntress saw commands reach endpoints in several ScreenConnect instances within minutes, with no matching login activity and with the commands linked to RMM+ in the logs. The operator then used the console's Run command feature to run commands as SYSTEM on groups of endpoints.
Por que é vulnerável
The root cause is an insecure default combined with a missing check. The access key setting defaults to empty, and the authentication code does not reject an empty key, so an unconfigured install accepts a blank one. The setting's description tells admins to set a strong key, which left security to the administrator rather than enforcing it. Huntress said most RMM+ installs it saw were legitimate, usually added for a project and left in place, so many probably went unconfigured. The articles do not describe what a fixed version changes.
Onde está
The flaw is in the extension's RMMPlus.AccessKey setting (IsServerOnly), whose DefaultValue is empty, and in the authentication check that accepts it; no file or function is named.
Como foi descoberta
Huntress saw suspicious activity on endpoints tied to multiple ScreenConnect environments at about 17:47 UTC on November 11, 2026, with 288 hosts hit over 90 minutes. At 22:45 UTC ConnectWise published an advisory saying five independent third-party extensions might be involved and that it had not yet found the initial access vector or the full scope; it disabled them across 400 partner environments. Later that evening Huntress linked the activity to RMM+ and the blank-key behavior, and Mendy Green helped validate the findings. Huntress also noted similar worm-like activity in September 2026.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No public proof of concept is described. The flaw was exploited in real attacks that delivered the SCKit toolkit, a 16-file package of scripts that spreads laterally, and Huntress published indicators of compromise rather than exploit code. Because it is actively abused, treat patching as urgent: disable RMM+ and related plugins and set a strong access key.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 05:16.
Linha do tempo
-
SCKit Worm Exploits ScreenConnect RMM+ Extension Authentication Flaw to Deploy Rogue Clients Across Hundreds of Endpoints
ler a análise desta fonte ocultar
On November 11, 2026, threat actors exploited a critical authentication flaw in the RMM+ third-party extension for ConnectWise ScreenConnect, allowing unauthorized mass deployment of rogue ScreenConnect clients and the SCKit toolkit across at least 288 endpoints in 48 organizations. The flaw in RMM+ versions 1.0.31 and 1.0.32 permitted blank access keys, bypassing user accounts, roles, and MFA, enabling the attacker to remotely execute commands via ScreenConnect consoles without login activity. The SCKit kit is a multi-component worm that spreads laterally and attempts console takeover and session cookie relay, although the latter has not been successfully observed in live infections. ConnectWise disabled RMM+ and related plugins and issued advisories urging on-premises partners to do the same. Huntress has provided extensive indicators of compromise and remediation guidance to help defenders detect and eradicate the infection. The attack chain relies on abusing ScreenConnect's Run command feature and installing persistent rogue clients to maintain control; compromised technician workstations pose additional risk if used to connect to infected endpoints, possibly spreading the worm further.