Starting around 17:47 UTC on November 11, attackers used access to cloud-hosted ScreenConnect panels to push commands through ScreenConnect’s Run Command feature and install their own ScreenConnect clients on managed endpoints. Huntress, which detected it, counts at least 288 endpoints across 48 organizations; its earliest public figure, as BleepingComputer relayed it, was six compromised managed service providers (MSPs) and 286 endpoints, and the numbers were still rising. The rogue clients give the attacker remote access that no longer depends on the original panel, and they deliver a custom toolkit Huntress calls SCKit. Huntress says SCKit spreads worm-like: when a technician connects to an infected customer machine through ScreenConnect, the malware can move to the technician’s workstation, steal saved browser sessions and authentication tokens, and pivot to other ScreenConnect panels that technician can reach.
ConnectWise says it has found no evidence that its own infrastructure was compromised or that ScreenConnect itself has a vulnerability. Its initial assessment is that the attacker abused independent third-party extensions installed in partner environments. It identified about 400 partner environments with at least one extension from the “RMM+” family and disabled five extensions where it could: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. On-premises partners must disable them on their own. ConnectWise says the initial access method and full scope remain under investigation, and that having the extensions installed does not by itself mean a compromise. Huntress later said the activity appears tied to RMM+, and that versions 1.0.31 and 1.0.32 accepted a blank access key if an administrator had never set one; because the extension authenticates with that shared key, Huntress says it bypasses ScreenConnect’s user accounts, roles and MFA. That explanation comes from Huntress, not ConnectWise. Huntress also lists the newest ScreenConnect builds (26.6.6.9747 and 26.7.6.9783) among those affected, so updating ScreenConnect alone is not the fix.
How to check if you’re affected
Affected products are ScreenConnect environments, cloud-hosted or on-premises, that have any of the five extensions above installed, and any endpoint managed through a panel where unexpected Run Command activity occurred. Steps drawn from the ConnectWise advisory, Huntress and Sophos:
- Verify the five extensions are disabled, do not re-enable or reinstall them, and follow ConnectWise’s extension removal instructions (on-premises partners must do this themselves).
- Review Run Command and Toolbox history for mass activity you did not start, and look for an unauthorized second ScreenConnect client on managed endpoints (Huntress). Sophos saw
curl.exedownloadScreenConnect.ClientSetup.msitoC:\Windows\TEMP\sc.msiandmsiexec.exeinstall it silently, followed by PowerShell fetching a second-stage script. - Do not connect to a suspect host through ScreenConnect; Huntress says an interactive session can spread the malware to the technician’s workstation. Use EDR live response, WinRM or another out-of-band tool, and treat any technician workstation that already connected as potentially exposed, investigating it from a clean device.
- Isolate the host, but do not treat isolation as cleanup: Huntress observed reinfection after isolation was lifted. It lists the rogue client service, the
TrapWatchscheduled task,C:\ProgramData\RelayTrap\, toolkit files in%TEMP%(sckit-*,Panel-Lateral.ps1,runnew.cmd,ToolboxRelayUploader.exe,sqlite3.exe) and aRelayTrapLiteAlertvalue underHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runto remove, after verifying the legitimate ScreenConnect client separately. - From a clean device, end active ScreenConnect and identity-provider sessions, reset credentials, enforce MFA and remove unneeded admin access (ConnectWise, Huntress).
ConnectWise’s published indicators, as listed by The Hacker News, include the IP addresses 185.99.255[.]28 and 155.94.150[.]39 and the domains ns[.]mo7sen[.]dev, sc[.]payproofkit[.]com, cdn007-digitaldownloads[.]com, newnewnew[.]gotdns[.]org and Soxnewwork[.]homedns[.]org; check its advisory for the full list. ConnectWise stresses these support investigation and do not prove how the attacker got in. If you are not an MSP but a provider manages your devices with ScreenConnect, our suggestion, not the vendors’: ask the provider whether it used the listed extensions and whether it has reviewed its panel for this activity.
Earlier ScreenConnect and ConnectWise coverage here: ConnectWise Warns of Unpatched ScreenConnect File Transfer Flaw and Stolen ConnectWise Credential Hits 173 Microsoft 365 Tenants. Neither source says this campaign is connected to those earlier incidents.
Sources
- ConnectWise Trust Center: ScreenConnect security advisory (precautionary extension disabling and partner guidance)
- Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays
- Sophos X-Ops: Malicious ScreenConnect deployments observed
- Huntress post on r/msp: active malware campaign abusing ScreenConnect (linked from BleepingComputer)
- BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations
- The Hacker News: ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients