Huntress Reports ScreenConnect Campaign Compromised 288 Hosts Across 48 Organizations

Summary

Huntress reports that attackers abused ScreenConnect access and a likely RMM+ authentication flaw to compromise 288 hosts across 48 organizations. ConnectWise disabled five related extensions; both companies released IOCs and recommended disabling them.

Key points

Huntress says attacks observed November 11 affected at least six MSPs and 288 hosts across 48 organizations; all 288 hosts were hit within 90 minutes.
Attackers abused access to cloud-hosted ScreenConnect panels to run commands on managed endpoints and deploy rogue ScreenConnect clients and the SCKit malware toolkit.
Huntress says SCKit can provide persistent backdoor access, intercept session cookies, and self-replicate; it cautioned that not all functionality was observed during incidents.
The attackers likely exploited an authentication flaw in RMM+ versions 1.0.31 and 1.0.32, which could accept a blank access key if an administrator had not configured one.
Huntress found commands reaching endpoints without corresponding login activity in reviewed logs, which were linked to RMM+.
ConnectWise disabled five RMM+ family extensions across approximately 400 ScreenConnect environments. It said extension presence alone does not establish compromise.
Huntress and ConnectWise released campaign IOCs and recommended disabling the extensions in on-premises ScreenConnect deployments.

Article Details

Victim Organization: Not disclosed
Victim Domain: Not disclosed
Incident Type: Unauthorized access to ScreenConnect panels, followed by deployment of rogue ScreenConnect clients and the SCKit malware toolkit.
Affected Records: At least 288 hosts across 48 organizations, including at least 6 MSPs.
Operational Impact: Attackers issued commands to all 288 compromised hosts within 90 minutes. SCKit provides persistent backdoor access, can intercept session cookies, and can self-replicate; Huntress noted that not all payload functionality was observed during the incidents. ConnectWise disabled five RMM+ family extensions across approximately 400 ScreenConnect environments.
Ransom Or Extortion: Unknown
Claim Status: confirmed

Malware

sckitThe attackers’ commands deployed rogue ScreenConnect clients and a malware toolkit called SCKit that provides persistent backdoor access, intercepts session cookies, and can self-replicate.

Vendors

ConnectWiseA threat actor has compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a fresh campaign, cybersecurity outfit Huntress reports.

Products

Labtech PlusIn response, ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.RMM PlusIn response, ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.RMM Plus Password LinkIn response, ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.RMM+As part of the attacks, the hackers exploited a vulnerability in RMM+, a third-party extension for managing ScreenConnect sessions that uses a shared access key to bypass ScreenConnect’s authentication mechanism.RMM+ Password LinkIn response, ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.ScreenConnectA threat actor has compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a fresh campaign, cybersecurity outfit Huntress reports.