Attackers have used compromised ScreenConnect panels to deploy rogue clients onto at least 288 managed endpoints across 48 organizations, researchers at Huntress reported after detecting the activity on November 11, 2026 at about 5:47 p.m. UTC.
Huntress: rogue ScreenConnect clients on 288 endpoints across 48 organizations
Huntress investigators described a two‑step, worm‑like attack that begins when an adversary uses a compromised ScreenConnect panel's Run Command feature to push a malicious ScreenClient to endpoints. Those clients deliver a toolkit Huntress calls SCKit, which establishes persistent remote access and "creates a relay trap for intercepting session cookies," researchers Ben Nahorney and Susannah Matt said.
Huntress said the deployment created persistent backdoors that do not depend on the original panels, and that the activity can pivot back to technicians' workstations if a technician connects to an infected endpoint. The firm added that, to date, it has not observed a completed jump from an infected endpoint to a technician workstation or from a technician workstation to other endpoints, though analysts reconstructed functionality that would enable those moves from script and tool analysis.
ConnectWise disables five third‑party extensions; urges vigilance
ConnectWise said on its advisory page there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve a threat actor's abuse of independent third‑party extensions installed in partner environments," the company said, while noting it is continuing to validate that assessment and that "the initial access method and full scope remain under investigation."
As a precaution, ConnectWise has disabled five third‑party extensions in partner environments and urged on‑premises partners to disable them as well. The extensions named for precautionary disabling are:
- Labtech Plus
- RMM Plus
- RMM+
- RMM Plus Password Link
- RMM+ Password Link
ConnectWise also said it identified roughly 400 partner environments with at least one of the listed extensions installed, while stressing that the presence of the extensions alone "does not indicate or establish compromise." The company recommended partners ensure security controls are running, preserve suspicious activity logs, and watch for unusual sign‑ins, new administrator accounts, unexpected extension installations, remote commands, Toolbox activity, unapproved remote‑access software, and unexpected support requests or password resets.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadSCKit, droppers, and the worm‑like lateral chain
Huntress outlined the technical chain used to deliver the malicious toolkit. SCKit is delivered as an encrypted payload and via a Base64‑encoded dropper named "sckit‑run.bat," which contacts an external server to fetch a PowerShell payload, "sckit‑decoder.ps1," that launches the toolkit. Other components add Microsoft Defender exclusions, install a second attacker‑controlled ScreenConnect client, create a scheduled task named "TrapWatch," and replace a legitimate ScreenConnect installation with an attacker‑controlled copy.
Huntress reconstructed additional functionality intended to spread from a technician workstation back to panels: a "Run‑Lateral‑Full.bat" dropper contacts an external server (ns[.]mo7sen[.]dev) to download a loader that gathers the workstation's unique ID and returns a tailored encrypted kit. Scripts named "Panel‑Lateral.ps1" and "LabConfig.ps1" are designed to steal the .aspxauth session cookie from a workstation and attempt to replay it against the panel. A utility called "ToolboxRelayUploader.exe" can upload a payload to a panel's Shared Toolbox; a panel request then tells every reachable session to run that toolbox item, potentially installing the trap across endpoints.
Huntress further noted signs that at least one of the scripts is generated by a large language model, pointing to detailed source‑code references and explanatory comments embedded in the script content.
Sophos telemetry, instance IDs, and indicators of compromise
Sophos reported unauthorized ScreenConnect client deployments following the same pattern and identified three ScreenConnect instance IDs used as likely compromised launch points: d905b2b1b165d0a9, 4b8f4089ddaac6a9, and df1f7ef0cfacd0d8. Sophos also listed IDs of additional malicious instances observed: 2588ef5c15954b10 and ed630cc2c873b091.
Observed infection activity included a command where curl.exe downloaded ScreenConnect.ClientSetup.msi from 185.99.255[.]28 to C:\Windows\TEMP\sc.msi and launched msiexec.exe to install the client silently. Sophos also observed staged batch files and PowerShell with execution‑policy bypass retrieving a second‑stage script from ns[.]mo7sen[.]dev/EadF.php?p=4.
ConnectWise and other responders have shared indicators of compromise, including IPs (185.99.255[.]28; 155.94.150[.]39), domains (ns[.]mo7sen[.]dev; sc[.]payproofkit[.]com; cdn007‑digitaldownloads[.]com; newnewnew[.]gotdns[.]org; Soxnewwork[.]homedns[.]org), and artifacts such as sckit‑run.bat, sckit‑decoder.ps1, TrapWatch.ps1, Panel‑Lateral.ps1, Run‑Lateral‑Full.bat, runnew.cmd, ToolboxRelayUploader.exe, and Sqlite3.exe.
How MSPs, security teams, and customers are responding
- MSPs are being asked to check Run Command history and to look for sequential tagging that Huntress observed; the threat actor has been seen tagging compromised MSPs with a sequential number, and Huntress noted observed tags start partway through the sequence, suggesting earlier compromises may exist.
- Security teams are preserving suspicious logs, ensuring security controls and multi‑factor authentication are enforced, and looking for signs listed by ConnectWise including unfamiliar sign‑ins, new admin accounts, unexpected extension installs, and unapproved remote‑access software.
- Customers and technicians are being advised to remain vigilant for unexpected support requests, password‑reset messages, software downloads delivered through trusted channels, and Toolbox activity tied to ScreenConnect panels.
Investigations are ongoing: ConnectWise said its initial assessment points to abuse of third‑party extensions but is still validating that view, and Huntress continues to probe the precise initial access method, which telemetry currently suggests could be compromised credentials or hijacked operator sessions. The chain of artifacts, instance IDs, and domain callbacks published by responders provides concrete leads for defenders as the incident response continues.
