An intruder installed attacker-controlled copies of remote-management software on at least 288 computers across 48 organizations — roughly a third of those machines within the first 10 minutes and all of them within about 90 minutes, according to Huntress.
Huntress: rapid, coordinated pushes through cloud-hosted panels
Security researchers at Huntress traced the incident to activity Wednesday in which an attacker gained access to multiple cloud-hosted ScreenConnect panels and pushed commands to groups of managed endpoints. Huntress said the intruder’s actions resulted in attacker-controlled copies of the remote-management software being installed on at least 288 endpoints across 48 organizations. The company described the campaign as rapid and worm-like: roughly a third of infected machines were reached within the first ten minutes, and the full set within about ninety minutes.
RMM+ extension identified as the entry point
Huntress traced the activity to a third-party extension named RMM+, one of five independently developed extensions that ConnectWise later disabled. RMM+ allows other tools to manage ScreenConnect sessions without a user working through the console; Huntress said it “bypasses ScreenConnect’s user accounts, roles, and MFA,” authenticating instead with a shared access key. In RMM+ versions 1.0.31 and 1.0.32 that key “defaulted to blank, meaning the authentication check didn’t reject an empty value and a caller could pass the check when no key had been configured.” Huntress observed that most installations appeared legitimate and were “usually added for a project and left in place.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSCKit: how the attacker preserved a normal appearance while taking control
Huntress calls the malware package SCKit. According to the company, SCKit installed rogue ScreenConnect clients, stopped the legitimate client, and positioned the attacker’s copy to take its place while reusing the real client’s own code libraries so the machine “still looks normal.” The kit also included code intended to steal a user’s session cookie and replay it against the panel to reach other customers’ systems, though Huntress said attempts to do that have “failed in every recovered host log we have checked so far.”
ConnectWise response and ongoing investigation
ConnectWise said it was investigating reports of unauthorized access to certain partner ScreenConnect environments and took action to disable five independently developed extensions “across approximately 400 partner environments wherever it could take action.” The company said it had “found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.” ConnectWise added that “our initial assessment suggests the activity may involve a threat actor’s abuse of independent third-party extensions installed in partner environments.” The vendor also said the initial access method and full scope remain under investigation.
Context: recent CVE and a separate supply-chain episode
The Huntress alert follows related work the company began tracking in September, when ConnectWise released a security update for a file-transfer flaw in ScreenConnect, CVE-2026-84869, which was rated 9.9 out of 10 on the CVSS scale. The episode also arrived nearly a month after ConnectWise addressed a supply-chain attack that Microsoft later attributed to Storm-0940, a China-state-aligned group that used the ARTEX AI framework to automate password spraying and exploit privileged access to customers’ Microsoft 365 environments.
What this means for managed-service providers, security teams, and extension developers
- Managed-service providers and ConnectWise partners: the vendor’s action to disable five extensions in roughly 400 partner environments underscores that partner-developed add-ons can be an operational dependency and an access vector; partners will likely need to inventory extensions and remove or reconfigure those that use shared keys.
- Security and IT teams at affected organizations: Huntress’s timeline — a third of hosts reached in ten minutes, all within ninety — highlights the speed of propagation and the urgency of rapid detection and containment when orchestration channels are abused.
- Extension developers and integrators: the RMM+ finding — a shared access key that could default to blank in specific versions — points to the operational risk of authentication designs that bypass platform account controls and multifactor protections.
The record in this incident so far is precise about scope and technique but stops short of attribution: neither Huntress nor ConnectWise have named an actor, and ConnectWise said the initial access method and full scope remain under investigation. The immediate, observable fallout — disabled extensions across hundreds of partner environments, 288 compromised endpoints, and a malware kit that aimed to preserve a normal client appearance while inserting attacker control — leaves a clear, practical challenge for operators: where third-party extensions create alternative authentication paths, the risk can be both rapid and wide-reaching. Watch for the vendor’s follow-up on whether changes to extension policies, default-key handling, or partner vetting will be part of the remediation roadmap.
