Attackers Turn ScreenConnect Panels Against 288 Machines as a Third-Party Extension Comes Under Scrutiny

Attackers used ScreenConnect management panels to install rogue remote-access clients on at least 288 machines across 48 organizations, turning a tool meant for technical support into a delivery system for their own software. Huntress observed the deployments within 90 minutes on November 11.

The security firm traced a possible opening to RMM+, an independent extension that lets other software manage ScreenConnect sessions. Huntress says versions 1.0.31 and 1.0.32 accepted an empty access key when an administrator had never configured one. Its researchers found that many installations appeared legitimate, added for a project and then left behind.

ConnectWise disabled five related extensions wherever it could intervene. Approximately 400 partner environments had at least one installed, a count the company explicitly distinguishes from confirmed compromises. On-premises operators must disable the extensions themselves.

Once inside a panel, the attackers used its Run Command feature to deploy unauthorized clients and a toolkit called SCKit. Huntress also found code intended to carry the attack from an infected endpoint to a connecting technician and then onward. It says that takeover attempt failed in every recovered host log it examined.

The distinction matters for anyone maintaining the software. ConnectWise disclosed a separate file-transfer security issue in September. The company says client version 26.6.5, released September 8, blocks SCKit's attempted endpoint-to-technician spread. Updating a cloud console does not automatically update technician clients, and that protection does not remove an existing compromise.

In its November 12 update, ConnectWise said it had found no evidence that its infrastructure was compromised or that initial access involved a ScreenConnect vulnerability. The extension investigation remains open. Disabling a plugin can close a door, but it does not establish that the software already pushed through a management panel is gone.

Some offers on this page may be paid placements or contain affiliate links.