Huntress Finds ScreenConnect Malware Campaign Hitting 288 Hosts

A fresh campaign targeting ScreenConnect customers has seen attackers compromise hundreds of endpoints by abusing a vulnerability in a third‑party extension called RMM+. Huntress reports that the activity was observed on 11 November, with the attackers gaining unauthorised access to cloud‑hosted ScreenConnect panels to issue commands on managed endpoints. In total, at least six MSPs and 288 hosts across 48 organisations were affected, with all 288 compromised hosts contacted within 90 minutes.

The attackers deployed rogue ScreenConnect clients alongside a malware toolkit named SCKit, which provides persistent backdoor access, intercepts session cookies, and can self‑replicate. The campaign begins when the rogue components are launched via ScreenConnect panels, waits for a technician to connect to the endpoint, then attempts to spread to other sessions the technician can access and to other panels.

The vulnerability points to a flaw in the RMM+ extension, which uses a shared access key to bypass ScreenConnect authentication. Huntress says versions 1.0.31 and 1.0.32 of the extension default the access key to blank if not configured, allowing an attacker to authenticate with an empty value.

ConnectWise notes that the API used by these extensions can execute remote commands and that access is protected by a partner‑configured passphrase; they also state that presence of the extensions does not in itself prove compromise. In response, ConnectWise disabled five RMM+ extensions across roughly 400 ScreenConnect environments: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. Huntress and ConnectWise have issued IoCs and recommend disabling the extensions in on‑premises ScreenConnect deployments.