Science & Tech · Cybersecurity · 1 hr ago
ScreenConnect malware campaign hits 288 machines across 48 organizations
Hackers compromised at least 288 machines across 48 organizations using ConnectWise’s ScreenConnect remote support system.
Huntress said the attacks affected at least six managed service providers, which use remote tools to support customers’ computers.
The attackers used a third-party extension called RMM+ to run commands without matching login activity.
Versions 1.0.31 and 1.0.32 could accept a blank access key if an administrator had not set one, potentially bypassing ScreenConnect’s normal authentication controls, including multi-factor authentication.
The malware toolkit, called SCKit, installs a rogue ScreenConnect client to keep remote access and is designed to spread to technicians’ computers and other systems they manage.
Huntress said it has not observed that attempted spread succeeding.
ConnectWise disabled five related extensions in about 400 environments, but their presence alone does not mean those systems were compromised.
The companies recommend disabling the extensions on locally hosted ScreenConnect systems, and Huntress and ConnectWise have shared indicators to help organizations check for the attack.
A campaign using a possible flaw in a third-party ScreenConnect extension compromised at least 288 hosts across 48 organizations.
Huntress said the attacks affected at least six managed service providers and were carried out within 90 minutes.
The attackers used the extension to run commands and deploy rogue ScreenConnect clients and a malware toolkit called SCKit.
ConnectWise disabled five extensions from the RMM+ family across about 400 ScreenConnect environments.
ConnectWise said it had found no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect itself.
- Who
- A threat actor; Huntress attributed the campaign to hackers. At least six managed service providers and 48 organizations were affected.
- What
- Attackers used a third-party ScreenConnect extension to run commands and deploy malware, compromising at least 288 hosts.
- When
- The attacks were observed on November 11, 2026.
- Where
- Cloud-hosted ScreenConnect panels and managed endpoints; affected organizations were not named.
- Why
- The attackers’ motive is Not stated. Huntress said a flaw in RMM+ versions 1.0.31 and 1.0.32 may have allowed access using a blank key.
This story does not have two clearly opposing sides.
The attacks were observed on cloud-hosted ScreenConnect panels.
Attackers compromised all 288 hosts reported by Huntress.
ConnectWise disabled five RMM+ family extensions across approximately 400 ScreenConnect environments.
- Compromised hosts
- At least 288
- Affected organizations
- 48
- Affected managed service providers
- At least 6
- RMM+ versions cited
- 1.0.31 and 1.0.32
- Extensions disabled
- 5 across approximately 400 environments
2 sources
What people are saying
At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.
Their presence alone does not establish compromise. These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup.
We have not observed that method to spread work successfully. The console-takeover attempt failed in every recovered host log we have checked so far.