ScreenConnect Attacks Target 288 Endpoints Across 48 Organizations Using Rogue Clients
FHN 
A new cyberattack campaign targeting ConnectWise ScreenConnect deployments has affected at least 288 endpoints across 48 organizations, raising concerns about the security of managed service providers (MSPs) and their remote access infrastructure.
The campaign involves attackers abusing compromised ScreenConnect environments to deploy unauthorized remote-access clients on customer devices. Security researchers warn that the activity could also allow attackers to move from infected endpoints to technicians’ workstations and potentially access additional customer environments.
ConnectWise Disables Five Third-Party Extensions
ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precautionary measure following reports of unauthorized access.
The extensions identified include:
- Labtech Plus
- RMM Plus
- RMM+
- RMM Plus Password Link
- RMM+ Password Link
According to ConnectWise, the activity may involve the abuse of independent third-party extensions installed in partner environments. However, the company has not confirmed the initial access method and stated that the presence of these extensions alone does not establish that an environment has been compromised.
The company also clarified that there is currently no evidence indicating a compromise of its infrastructure or a vulnerability in the ScreenConnect software itself.
Attackers Deploy Rogue ScreenConnect Clients
Researchers at Huntress identified the campaign on November 11, 2026. Their investigation found attackers using compromised ScreenConnect panels and the platform’s legitimate Run Command functionality to deploy unauthorized ScreenConnect clients across managed endpoints.
The rogue clients establish persistent remote access outside the legitimate MSP management environment, potentially allowing attackers to maintain control even if the original compromised panel is secured.
Huntress initially reported activity involving six compromised MSPs and hundreds of affected endpoints, with the number of impacted organizations continuing to increase.
SCKit Malware Enables Potential Lateral Movement
The rogue clients deliver a custom malicious toolkit identified as SCKit. The malware contains several components designed to establish persistence, maintain unauthorized access and facilitate lateral movement.
One particularly concerning capability, called RelayTrap, is designed to exploit interactions between infected customer devices and technicians’ workstations.
When a technician connects to an infected endpoint through ScreenConnect, the malware may attempt to compromise the technician’s workstation, steal authentication tokens and session cookies, and use the technician’s access to reach other ScreenConnect environments.
Researchers have also identified scripts designed to deploy additional malicious clients, create scheduled tasks, modify Microsoft Defender exclusions and abuse shared administrative tools.
Although researchers discovered functionality intended to spread between endpoints and technician workstations, not every stage of the potential infection chain has been observed during confirmed incidents.
About the Author
