ScreenConnect campaign compromises 288 hosts through RMM+ authentication flaw
Original title: Hackers Deploy Malware in Fresh ScreenConnect Campaign
Huntress says attackers hit at least six MSPs and 48 organizations within 90 minutes on November 11, deploying SCKit.
Huntress reports a threat actor used unauthorized access to cloud-hosted ConnectWise ScreenConnect panels to run commands on managed endpoints. The campaign compromised at least six MSPs and 288 hosts across 48 organizations, deploying rogue ScreenConnect clients and the SCKit toolkit for persistent backdoor access, session-cookie interception, and self-replication. Huntress attributes access to an authentication flaw in the third-party RMM+ extension versions 1.0.31 and 1.0.32, where an unconfigured access key defaults to blank. ConnectWise disabled five RMM+ family extensions across about 400 environments and both firms released indicators of compromise.
Unconfirmed: Huntress says some SCKit functions were found by payload analysis and not observed in every incident.
- Commands reached endpoints within minutes, with logs tied to RMM+ and no corresponding login activity.
- SCKit waits for a technician connection, then tries to infect that workstation and other sessions.
- Disabled extensions include Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.
- ConnectWise says an extension's presence alone does not establish compromise.
Impact: Persistent backdoor access and interception of session cookies
| Product | Affected |
|---|---|
| RMM+ | 1.0.31 and 1.0.32 |
- 1.Disable RMM+ family extensions on on-premises ScreenConnect deployments.
- 2.Review indicators of compromise released by Huntress and ConnectWise.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1539 Steal Web Session CookieT1219 Remote Access Software
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Malware
- SCKit
- Organizations
- Huntress
From the original article
2 min read at securityweek.com
The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The post Hackers Deploy Malware in Fresh ScreenConnect Campaign appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.