A ScreenConnect add-on let attackers push malware to 288 PCs without logging in. Turn off RMM+ now

Attackers used a third-party ScreenConnect extension called RMM+ to send commands to managed computers without logging in, installing their own copy of ScreenConnect and a toolkit called SCKit. Huntress counted at least 288 machines across 48 organizations, all hit within about 90 minutes on Wednesday.

ConnectWise has switched off the extension and four related ones in about 400 partner environments. On-premises servers have to do it themselves.

A ScreenConnect add-on accepted a blank password, and attackers used it to push malware to 288 PCs in 90 minutes. Turn off RMM+ and its sister extensions now.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A ScreenConnect add-on let attackers push malware to 288 PCs

RMM+ lets other tools run ScreenConnect commands without a technician in the console. It skips ScreenConnect’s own accounts, roles and MFA and checks a shared access key instead. Huntress found that in RMM+ versions 1.0.31 and 1.0.32, if nobody had set that key, a blank one was accepted.

Starting about 17:47 UTC on November 11, an operator used the Run command feature on several cloud-hosted ScreenConnect panels to install an attacker-controlled ScreenConnect client and SCKit on endpoints, running as SYSTEM. The kit then stopped the real client and put the attacker’s copy in its place.

• Extensions ConnectWise disabled: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link.
• ConnectWise’s view: no evidence of a breach of its own infrastructure or a flaw in ScreenConnect itself. The presence of an extension does not by itself mean compromise.

MSPs and IT teams with RMM+ or its sister extensions installed

One ScreenConnect panel can reach every customer machine an MSP manages, so a single unset key exposed whole client lists. SecurityWeek reports at least six MSPs were hit.

SCKit is also built to spread back to technicians. It tries to steal a technician’s ScreenConnect session cookie when they connect to an infected machine, then push itself to every session that technician can reach. Huntress says that step has failed in every host log it has checked so far, but it means connecting to a suspect machine to clean it up is risky.

Disable the five extensions and check for a second client

• On on-premises ScreenConnect servers, disable Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link now, and don’t reinstall them until ConnectWise says it is safe.
• Review Run command and Toolbox history since November 11 for commands nobody on your team sent.
• On managed endpoints, look for a second ScreenConnect client service you didn’t install.
• Don’t open a ScreenConnect session to a machine you suspect. Use EDR live response or another tool, and isolate it.
• From a clean device, end active ScreenConnect web sessions and rotate technician passwords and identity provider sessions.

Details

• Vulnerable extension: RMM+ 1.0.31 and 1.0.32 (third-party), blank access key accepted when none was configured. No CVE assigned.
• Scope (Huntress): at least 288 endpoints across 48 organizations; one third in the first 10 minutes. Affected ScreenConnect versions in the incidents include 26.6.6.9747 and 26.7.6.9783.
• ConnectWise advisory: posted November 11, 22:45 UTC. Initial access method and full scope still under investigation.
• Related: SCKit tries to use CVE-2026-84869, a ScreenConnect client file-transfer bug fixed in 26.6.5 in September. Blackpoint told BleepingComputer the attempt failed against a patched client.

Hunt / verify

• Check endpoints for C:\ProgramData\RelayTrap\, a scheduled task named TrapWatch, and a RelayTrapLiteAlert value under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
• Search C:\Windows\Temp and user temp folders for sc.msi, sckit-* files, Panel-Lateral.ps1 and ToolboxRelayUploader.exe.
• Look for connections to 185.99.255.28, newnewnew.gotdns.org and ns.mo7sen.dev, and for a ScreenConnect participant named Addmin.

Source: ConnectWise guidance for partners; Huntress report

Sources

• ConnectWise: ScreenConnect security update, guidance for partners
• Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
• SecurityWeek: Hackers Deploy Malware in Fresh ScreenConnect Campaign
• BleepingComputer: New worm-like SCKit malware targets MSPs in ScreenConnect attacks

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].