Hackers Exploit ScreenConnect Flaw to Spread Malware

“At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.” That caveat, issued by ConnectWise, sits against a more alarming tally: hackers used a compromised third‑party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations in an attack Huntress first flagged in a Reddit post.

Huntress's timeline and scope

Huntress's security operations center began tracking the incident at about 1747 UTC, reporting an active campaign that targeted cloud‑hosted ScreenConnect instances. Within 90 minutes the attackers had reached all 288 affected endpoints; roughly a third were compromised in the first ten minutes. At the time of its Reddit post, Huntress was watching six compromised managed service providers (MSPs) and more than 286 affected endpoints, with the company warning the numbers were still climbing.

Huntress also noted signs the campaign began earlier than its detection window: the attackers appeared to number victims sequentially, and the sequence suggested previous, unobserved infections.

RMM+ extension: the authentication weakness at the center

Huntress traced the activity to a possible authentication weakness in RMM+, a third‑party extension that enables other management tools to issue commands through ScreenConnect without technicians using the ScreenConnect console. Versions 1.0.31 and 1.0.32 of the extension contain a flaw that allows installations without a configured access key to accept a blank one.

Because RMM+ operates independently of ScreenConnect’s normal user accounts and authentication controls, Huntress warned an attacker could execute commands without defeating multi‑factor authentication. The researchers said the flaw matched what they observed in the wild: commands reached machines across several ScreenConnect installations despite there being no corresponding login activity.

SCKit toolkit: persistence, lateral aims, and a failed console take‑over so far

The attackers deployed a 16‑file malware toolkit Huntress has dubbed SCKit. The toolkit installs a separate ScreenConnect client so the attacker can maintain remote access even if the legitimate connection is shut down, and it contains code intended to spread the infection to IT technicians and potentially other customers those technicians manage.

According to Huntress, SCKit is also designed to turn an infected machine into a trap: if a technician connects through ScreenConnect, the toolkit attempts to transfer malware back to the technician’s workstation, steal authentication cookies, and use that access to reach other machines. Huntress said, “We have not observed that method to spread work successfully. The console‑takeover attempt failed in every recovered host log we have checked so far.”

Huntress additionally noted an unusual characteristic of some of SCKit’s C# code: detailed comments suggest parts of the code may have been generated with the help of a large language model, an observation Huntress flagged as an explanation for unusually explicit developer notes in malware components.

ConnectWise response and the immediate remediation steps

ConnectWise confirmed it was investigating unauthorized access to certain partner environments and identified approximately 400 installations that contained at least one extension from the RMM+ family. The company has disabled five extensions — including RMM+, RMM Plus, and Labtech Plus — wherever it can do so remotely, and it urged customers running their own ScreenConnect servers to do the same.

ConnectWise stressed the roughly 400 environments were identified because they had RMM+‑family extensions installed, not because they were necessarily compromised, and reiterated its statement that it had found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.

Both Huntress and ConnectWise are warning administrators against investigating suspected infections by remotely connecting through ScreenConnect. Instead they advise using other security tools to examine affected machines, search for rogue ScreenConnect clients, and audit commands that were run. Any malware must be removed before systems are returned to production, they cautioned.

What this means for MSPs, administrators, and technicians

• MSPs: Check for installed RMM+‑family extensions and follow ConnectWise's steps to disable them where possible; recognize that disabling extensions alone may not remove malware or persistence mechanisms already placed on endpoints.
• Administrators: Avoid using ScreenConnect to investigate suspected infections; look for rogue ScreenConnect clients, review command histories, and ensure complete removal of malicious software before reconnecting systems to the network.
• Technicians: Be aware that an infected endpoint may attempt to transfer malware back to investigative workstations and steal session cookies; use isolated, non‑ScreenConnect tools when performing incident response.

The episode underlines a specific danger: a third‑party extension operating outside a product’s native authentication model can become a conduit for rapid, cross‑customer compromise. ConnectWise has disabled extensions and is investigating access to partner environments, but it has not confirmed how the attackers initially gained entry. Huntress’s tally and technical analysis leave open whether additional MSPs and customers will surface as victims — and whether the toolkit’s console‑takeover capabilities will succeed in future attempts.

Original story at The Register