Huntress Reports Rogue ScreenConnect Clients on 288 Endpoints Across 48 Organizations
Summary
Huntress observed rogue ScreenConnect clients deployed across at least 288 endpoints in 48 organizations. Researchers detailed SCKit’s components and a reconstructed spread path, but the initial access method and successful lateral spread remain unconfirmed.
Key points
- ConnectWise disabled five third-party extensions as a precaution and identified about 400 partner environments where at least one was installed; it said extension presence alone does not establish compromise.
- Huntress observed rogue ScreenConnect clients pushed to at least 288 managed endpoints across 48 organizations. The initial access method remains unclear; telemetry points to compromised credentials or hijacked operator sessions.
- Researchers said the rogue clients deliver SCKit, which establishes persistent remote access and creates a relay trap for intercepting session cookies.
- SCKit is delivered through an encrypted payload and a Base64-encoded dropper; other components can add Microsoft Defender exclusions, create a scheduled task named TrapWatch, and install attacker-controlled ScreenConnect clients.
- Huntress reconstructed a possible spread path from endpoints through technicians’ workstations to other reachable endpoints, but said it had not observed a successful jump along that path.
- Sophos separately observed unauthorized client deployments, including a download from 185.99.255[.]28 and a second-stage script retrieved from ns[.]mo7sen[.]dev.
- ConnectWise and Huntress said they had no evidence of a ScreenConnect vulnerability; ConnectWise also reported no evidence that its own infrastructure was compromised.
Article Details
- Attack Vectors
- ConnectWise said its initial assessment suggested a threat actor may have abused independent third-party extensions installed in partner environments; the initial access method remains under investigation.
- Huntress telemetry pointed to compromised credentials or hijacked operator sessions for access to cloud-hosted ScreenConnect panels, but the exact method remains unclear.
- Attackers used ScreenConnect panel Run commands to deploy rogue clients to at least 288 endpoints across 48 organizations, according to Huntress.
- Rogue clients delivered SCKit through an encrypted payload and a Base64-encoded batch dropper. Scripts used PowerShell to retrieve and launch additional payloads.
- The malware added Microsoft Defender exclusions, installed another attacker-controlled ScreenConnect client, created a scheduled task, and replaced legitimate ScreenConnect installations with attacker-controlled copies.
- Scripts staged a lateral-spread capability involving a technician workstation and reachable endpoints, but Huntress said it had not observed a successful jump between endpoints, technician workstations, or other endpoints.
- Defensive Notes
- ConnectWise recommended partners disable the identified third-party extensions, ensure security controls are running, preserve suspicious activity logs, and remain vigilant.
- ScreenConnect users were advised to review Run Command history even if they had not received alerts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ns[.]mo7sen[.]dev | External server contacted by the lateral-spread dropper to download a loader, according to Huntress. |
| IPV4 | 185[.]99[.]255[.]28 | Host from which curl.exe downloaded the ScreenConnect client installer used in an unauthorized deployment, according to Sophos. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSCKit was delivered as an encrypted payload through a Base64-encoded dropper.T1053.005 · Scheduled TaskSCKit components created a scheduled task named TrapWatch.T1059.001 · PowerShellPowerShell retrieved and launched payloads, including a second-stage script from ns[.]mo7sen[.]dev/EadF.php?p=4.T1059.003 · Windows Command ShellBatch files including sckit-run.bat and Run-Lateral-Full.bat were used as droppers.T1078 · Valid AccountsHuntress telemetry pointed to compromised credentials as a possible means of gaining initial access; the method remains unclear.T1105 · Ingress Tool TransferScripts and curl.exe downloaded loaders, payloads, and a ScreenConnect client installer from external servers.T1219 · Remote Access ToolsAttackers deployed rogue ScreenConnect clients to establish remote access to managed endpoints.T1539 · Steal Web Session CookieSCKit created a relay trap for intercepting session cookies.T1562.001 · Disable or Modify ToolsSCKit components were designed to add Microsoft Defender exclusions.
People
Malware
Vendors
ConnectWiseConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access.HuntressCybersecurity company Huntress, which is also tracking the activity, said it has observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands with an aim to install rogue ScreenConnectSophosIn a separate alert, Sophos said it has also observed unauthorized ScreenConnect client deployments following the same modus operandi. The activity has originated from three ScreenConnect instance IDs -
Products
Microsoft Defender Antimalware PlatformOther components of the malware are designed to add Microsoft Defender exclusions, install a second attacker-controlled ScreenConnect client, create a scheduled task named "TrapWatch," and replace the legitimateScreenConnectIn an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software.