ConnectWise disables five extensions after rogue ScreenConnect client attacks
Original title: ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
Huntress first saw the activity on November 11 and has not observed a successful jump to a technician workstation.
ConnectWise disabled five third-party extensions after reports of unauthorized access and said it has no evidence of a ScreenConnect vulnerability or compromise of its infrastructure. About 400 partner environments had at least one listed extension. Huntress observed attackers using cloud-hosted ScreenConnect panels to push Run commands that installed rogue clients and SCKit on at least 288 endpoints across 48 organizations, first detected around 5:47 p.m. UTC on November 11, 2026. Huntress says current telemetry points to compromised credentials or hijacked operator sessions.
Unconfirmed: Initial access and full scope remain under investigation; Huntress has not confirmed a new vulnerability.
- Disabled extensions include Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.
- ConnectWise says extension presence alone does not establish compromise.
- SCKit adds Defender exclusions, a TrapWatch task, and a second rogue client.
- Huntress has not observed a successful jump from an infected endpoint to a technician workstation.
- On-premises partners were urged to disable the extensions and preserve suspicious logs.
Impact: Persistent remote access via rogue ScreenConnect clients and session-cookie theft
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | — |
- 1.Disable the five named third-party extensions and do not re-enable them.
- 2.Watch for unusual sign-ins, new admin accounts, unexpected Run Command or Toolbox activity.
- 3.Look for unapproved remote-access software on customer devices and technician workstations.
- ATT&CK
- T1219 Remote Access SoftwareT1078 Valid AccountsT1539 Steal Web Session CookieT1053.005 Scheduled TaskT1562.001 Disable or Modify Tools
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+Labtech Plus
- Malware
- SCKit
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn007-digitaldownloads.com | .]dev ns[.]mo7sen[.]dev/EadF.php?p=4 sc[.]payproofkit[.]com cdn007-digitaldownloads[.]com newnewnew[.]gotdns[.]org Soxnewwork[.]homedns[.]org Artif |
| domain | mo7sen.dev | -Full.bat"), which then connects to an external server ("ns.mo7sen[.]dev") to download a loader that gathers the workstation's uni |
| domain | newnewnew.gotdns.org | hp?p=4 sc[.]payproofkit[.]com cdn007-digitaldownloads[.]com newnewnew[.]gotdns[.]org Soxnewwork[.]homedns[.]org Artifacts: sckit-run.bat sck |
| domain | ns.mo7sen.dev | ddresses: 185.99.255[.]28 155.94.150[.]39 Domains and URLs: ns[.]mo7sen[.]dev ns[.]mo7sen[.]dev/EadF.php?p=4 sc[.]payproofkit[.]com c |
| domain | sc.payproofkit.com | and URLs: ns[.]mo7sen[.]dev ns[.]mo7sen[.]dev/EadF.php?p=4 sc[.]payproofkit[.]com cdn007-digitaldownloads[.]com newnewnew[.]gotdns[.]org |
| domain | soxnewwork.homedns.org | ]com cdn007-digitaldownloads[.]com newnewnew[.]gotdns[.]org Soxnewwork[.]homedns[.]org Artifacts: sckit-run.bat sckit-decoder.ps1 TrapWatch.ps |
| ipv4 | 155.94.150.39 | cators of compromise (IoCs) - IP addresses: 185.99.255[.]28 155.94.150[.]39 Domains and URLs: ns[.]mo7sen[.]dev ns[.]mo7sen[.]dev/Ead |
| ipv4 | 185.99.255.28 | e following indicators of compromise (IoCs) - IP addresses: 185.99.255[.]28 155.94.150[.]39 Domains and URLs: ns[.]mo7sen[.]dev ns[.] |
From the original article
5 min read at thehackernews.com
ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.