cyber.hendryadrian.com
Cyber Attack & Data Breach · cyberscoop.com

Huntress Says ScreenConnect Add-On Campaign Installed Rogue Clients on 288 Computers

· Original article ↗

Summary

Huntress says an intruder abused the RMM+ ScreenConnect extension to install rogue clients on at least 288 computers across 48 organizations. ConnectWise disabled five extensions and says the access method and full scope remain under investigation.

Key points

  • Huntress reported that at least 288 computers across 48 organizations received attacker-controlled ScreenConnect clients through accessed cloud-hosted panels.
  • Huntress traced the activity to RMM+, an extension that bypasses ScreenConnect accounts, roles, and MFA by using a shared access key.
  • In RMM+ versions 1.0.31 and 1.0.32, the key defaulted to blank, allowing a caller to pass the check when no key was configured.
  • The SCKit malware stopped the legitimate client and installed a rogue replacement that reused the original client’s code libraries.
  • SCKit included code to steal and replay session cookies, but Huntress said attempts had failed in all recovered host logs it reviewed.
  • ConnectWise disabled five independently developed extensions across approximately 400 partner environments where it could act; it said it found no evidence of a compromise of its infrastructure or a ScreenConnect vulnerability.
  • Neither company attributed the activity, and ConnectWise said the initial access method and full scope remain under investigation.

Article Details

Victim Organization
48 organizations using partner ScreenConnect environments; names not disclosed
Victim Domain
Not disclosed
Incident Type
Unauthorized access to partner ScreenConnect environments through abuse of the RMM+ third-party extension, followed by deployment of rogue ScreenConnect clients.
Affected Records
At least 288 computers across 48 organizations were affected.
Operational Impact
Rogue ScreenConnect clients were installed on affected computers, stopping and replacing legitimate clients. Huntress said attempts to steal and replay session cookies had failed in every recovered host log it checked.
Ransom Or Extortion
Unknown
Claim Status
confirmed

MITRE ATT&CK

T1219 · Remote Access ToolsRogue ScreenConnect clients were installed to provide remote access on affected computers.T1550.004 · Web Session CookieSCKit included code designed to steal and replay user session cookies; Huntress said the attempts had failed in the recovered host logs it checked.

Threat Actors

Storm-0940Microsoft later attributed a separate, earlier ConnectWise supply-chain attack to Storm-0940; the article does not attribute the ScreenConnect extension campaign to this group.

Malware

sckitThe malware, which Huntress calls SCKit, installed rogue ScreenConnect clients, stopped the legitimate client and positioned the attacker’s copy to take its place, reusing the real client’s own code libraries so the

Vendors

ConnectWiseConnectWise, which makes ScreenConnect, said it was investigating reports of unauthorized access to certain partner ScreenConnect environments and disabled five independently developed extensions across approximately

Products

ARTEX AI frameworkattack that Microsoft later attributed it to Storm-0940, a China-state-aligned group that used the ARTEX AI framework to automate password spraying and exploit privileged access to customers’ Microsoft 365RMM+Huntress traced the activity to RMM+, one of the disabled extensions, which lets other tools manage ScreenConnect sessions without a user working through the console.ScreenConnectSecurity researchers at Huntress said an intruder used access to multiple cloud-hosted ScreenConnect panels Wednesday to push commands to groups of managed endpoints, installing attacker-controlled copies of the

Tools

ARTEX AI frameworkattack that Microsoft later attributed it to Storm-0940, a China-state-aligned group that used the ARTEX AI framework to automate password spraying and exploit privileged access to customers’ Microsoft 365

Countries

Chinaafter ConnectWise dealt with a supply-chain attack that Microsoft later attributed it to Storm-0940, a China-state-aligned group that used the ARTEX AI framework to automate password spraying and exploit privileged

Related Articles