Attackers exploit ScreenConnect plugin flaw to infect 288 machines
Original title: Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
RMM+ 1.0.31 and 1.0.32 accept a blank access key, letting attackers run commands without defeating MFA.
Huntress says attackers used a third-party ScreenConnect extension to install the SCKit malware toolkit on at least 288 machines across 48 organizations, including six managed service providers, within 90 minutes. Versions 1.0.31 and 1.0.32 of RMM+ accept a blank access key when none is configured, and the extension sits outside ScreenConnect accounts and MFA. ConnectWise disabled five extensions, including RMM+, in about 400 installations and says it found no flaw in ScreenConnect itself.
Unconfirmed: ConnectWise has not confirmed initial access, and Huntress only suspects additional undetected MSP victims.
- Huntress first tracked more than 286 endpoints, later putting the total at 288.
- About a third of the endpoints were compromised in the first ten minutes.
- Confirmed affected ScreenConnect builds were 26.6.6.9747 and 26.7.6.9783.
- SCKit installs a separate ScreenConnect client for persistent remote access.
- Huntress has not seen the technician-workstation spread succeed.
Impact: Remote commands and malware install without defeating MFA
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | 26.6.6.9747 and 26.7.6.9783 |
| RMM+ | 1.0.31 and 1.0.32 |
- 1.Disable RMM+, RMM Plus, and Labtech Plus where installed.
- 2.Do not investigate suspected infections by connecting through ScreenConnect.
- 3.Look for rogue ScreenConnect clients and remove leftover malware before reconnecting.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1219 Remote Access SoftwareT1539 Steal Web Session Cookie
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Malware
- SCKit
- Organizations
- Huntress
From the original article
3 min read at theregister.comConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.