Huntress reports rogue ScreenConnect clients hit 48 organisations

Huntress has reported that rogue ScreenConnect clients are being deployed across managed environments after attackers gained access to cloud-hosted ScreenConnect panels.

The activity, first observed on 11 November 2026, involves a two-step worm-like operation: first, initial access is achieved via a compromised ScreenConnect panel’s Run Command feature to push a rogue ScreenClient onto endpoints; second, the malware propagates laterally when technicians connect to infected devices, potentially expanding to other panels the technician can reach.

Cybersecurity firm Huntress notes at least 288 endpoints across 48 organisations have been affected, with rogue components delivered by a toolkit named SCKit. Sophos corroborates observed unauthorized ScreenConnect deployments and identifies several ScreenConnect instance IDs in use, suggesting compromised instances are being used to execute commands and deploy additional malicious clients.

ConnectWise, which manages partner environments, emphasises there is no evidence of a platform or software vulnerability or infrastructure compromise; rather, the risk appears linked to third‑party extensions installed in partner environments.

The operation leverages a set of compromised or expired extensions, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link, which provide an API capable of executing remote commands but are secured by a passphrase chosen during setup. Indicators of compromise include specific IPs (185.99.255[.]28 and 155.94.150[.]39) and domains such as ns.mo7sen[.]dev and sc.payproofkit[.]com, plus artefacts like sckit-run.bat and ToolboxRelayUploader.exe.

Huntress describes SCKit as establishing persistent backdoors and intercepting session cookies to enable session replay across panels; the campaign also includes attempts to disable Defender protections and deploy a secondary attacker‑controlled ScreenConnect client. ConnectWise urges partners to monitor suspicious activity logs and enforce security controls, while stressing that the extensions’ presence alone does not prove a compromise.