Product
RMM+
- First Reported
- Nov 11, 2026
- Latest Reported
- Nov 12, 2026
Reported Context (5)
- Huntress, in an update, said it has identified a serious authentication flaw in versions 1.0.31 and 1.0.32 of RMM+, one of the five third-party ScreenConnect extensions that has already been blocked by ConnectWise. SCKit Malware Abuses ScreenConnect Sessions to Target MSP Technicians
- As part of the attacks, the hackers exploited a vulnerability in RMM+, a third-party extension for managing ScreenConnect sessions that uses a shared access key to bypass ScreenConnect’s authentication mechanism. Huntress Reports ScreenConnect Campaign Compromised 288 Hosts Across 48 Organizations
- Huntress traced the activity to RMM+, one of the disabled extensions, which lets other tools manage ScreenConnect sessions without a user working through the console. Huntress Says ScreenConnect Add-On Campaign Installed Rogue Clients on 288 Computers
- Huntress also believes the initial access was through RMM+, a third-party ScreenConnect extension that lets external management tools interact with ScreenConnect sessions without using the standard technician console. SCKit Malware Attempts Worm-Like Spread Through MSP ScreenConnect Sessions
- Huntress has learned that the activity seems to be related to one of these specific extensions that ConnectWise had disabled, RMM+. Huntress Links SCKit ScreenConnect Worm Activity to Flawed RMM+ Extension
CVE (1)
Malware (1)
People (10)
Threat Actors (1)
MITRE ATT&CK (16)
Vendors (3)
Products (6)
Tools (3)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.