Rogue ScreenConnect clients spread through RMM+ add-on, researchers say
Original title: Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
ConnectWise disabled five extensions in about 400 partner environments after SCKit reached 288 computers at 48 organizations.
Huntress said an intruder used cloud ScreenConnect panels to install rogue remote-management clients on at least 288 computers across 48 organizations, all within about 90 minutes. ConnectWise disabled five third-party extensions in about 400 partner environments and reported no compromise of its infrastructure or a ScreenConnect flaw. Huntress tied the activity to RMM+ versions 1.0.31 and 1.0.32, which accepted a blank shared key and bypassed accounts, roles, and MFA. The SCKit malware swapped in attacker clients. Attribution and scope remain under investigation.
Unconfirmed: Initial access, full scope, and attribution remain under investigation, and ConnectWise has not confirmed a ScreenConnect flaw.
- About a third of the 288 machines were reached in the first 10 minutes.
- RMM+ authenticates with a shared access key rather than ScreenConnect MFA.
- In versions 1.0.31 and 1.0.32, that key defaulted to blank.
- Cookie-replay attempts failed in every recovered host log Huntress checked.
- Neither company has attributed the activity.
Impact: Rogue remote-management clients on managed endpoints
| Product | Affected |
|---|---|
| RMM+ | 1.0.31 and 1.0.32 |
- 1.Review environments for RMM+ 1.0.31 or 1.0.32 with a blank access key.
- 2.Look for rogue ScreenConnect clients that replaced the legitimate client.
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Malware
- SCKit
- Organizations
- Huntress
From the original article
3 min read at cyberscoop.com
ConnectWise disabled five third-party extensions across about 400 partner environments after researchers linked a worm-like toolkit to one of them. The post Rogue remote-access campaign spread through ScreenConnect add-on, researchers say appeared first on CyberScoop.
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.