THE CRUNCH
A threat actor compromised at least six managed service providers and 288 hosts across 48 organisations in a fresh campaign against ConnectWise ScreenConnect, according to the cybersecurity firm Huntress. The attacks were observed on 11 November, when the hackers used unauthorised access to cloud-hosted ScreenConnect panels to run commands on managed endpoints, hitting all 288 compromised hosts within 90 minutes.
The entry point was RMM+, a third-party extension for managing ScreenConnect sessions. Huntress's analysis suggests versions 1.0.31 and 1.0.32 contained a serious authentication flaw: if an administrator had never configured the extension's access key, RMM+ would accept a blank one, letting attackers bypass ScreenConnect's authentication with an empty value. Commands reached endpoints within minutes, with no corresponding login activity in the logs.
The attackers' commands deployed rogue ScreenConnect clients and a toolkit dubbed SCKit, which provides persistent backdoor access, intercepts session cookies and can self-replicate. It waits for a technician to connect to a compromised endpoint, then infects the technician's workstation and attempts to spread to other sessions and panels they can reach. Huntress notes that not all of this functionality has been seen in actual incidents; some was found by analysing the payloads.
In response, ConnectWise disabled five extensions from the RMM+ family across roughly 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. The company cautions that the extensions' presence alone does not establish compromise, since their remote-command API is protected by a passphrase set during setup. Both Huntress and ConnectWise have published indicators of compromise and recommend disabling the extensions in on-premises ScreenConnect deployments.