Hijacked ScreenConnect panels push SCKit worm to 288 endpoints across 48 organizations

Managed service providers have spent the past decade consolidating the tools they use to run their customers' networks, and few products sit closer to the center of that stack than ConnectWise ScreenConnect. The remote monitoring and management platform lets a technician open a session on a client machine, run commands, move files and fix problems without ever leaving the desk. That convenience is the product. It is also the reason security researchers treat any compromise of a ScreenConnect panel as a potential incident across every organization that panel serves.

The platform's extension ecosystem widens that surface further. Partners can install independently developed plugins that add password links, session management and other workflow shortcuts. ConnectWise does not build all of them, and in this case the company's own advisory points at that gray zone: code running inside partner environments, with an API capable of executing remote commands, protected only by a passphrase set during setup.

On November 11, 2026, that gray zone became the center of a fast-moving incident. Attackers used access to cloud-hosted ScreenConnect panels to push commands into managed endpoints, installing rogue remote-access clients and a custom toolkit that researchers call SCKit. The campaign was not a slow, patient intrusion. It moved across hundreds of machines in about the time it takes to watch a film.

Security teams have long argued that remote management software is a high-value target because it is, by design, a legitimate path to run code everywhere. An attacker who controls a management panel does not need a novel exploit for each victim. The panel already holds the trust, the credentials and the deployment mechanism. That pattern is what makes the November campaign notable: the intruders appear to have borrowed the infrastructure of trust rather than broken it.

Key Facts

ConnectWise said in an advisory published on November 11, 2026, that it was investigating reports of unauthorized access to certain partner ScreenConnect environments. The advisory went out at 22:45 UTC and was updated at 02:45 UTC the following morning. The company said it had found no evidence of a compromise of ConnectWise infrastructure or of a vulnerability in ScreenConnect itself. Its initial assessment suggested the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments, with the initial access method and full scope still under investigation.

SecurityWeek reported on November 12, 2026, that Huntress traced the campaign to at least six managed service providers, 288 hosts and 48 organizations, with every one of those 288 compromised hosts reached within roughly 90 minutes. The attacks were observed on November 11, when hackers abused unauthorized access to cloud-hosted ScreenConnect panels to run commands on managed endpoints.

Huntress said attackers exploited a flaw in RMM+, a third-party extension for managing ScreenConnect sessions that uses a shared access key to bypass ScreenConnect authentication. Versions 1.0.31 and 1.0.32 accepted a blank access key if an administrator had never configured one, according to the firm. Investigators found commands reaching endpoints within minutes with no corresponding login activity, and logs linked to RMM+ instead of the usual authentication trail.

ConnectWise identified approximately 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. It disabled those extensions wherever it could act and told on-premises partners to disable them, while stressing that the presence of an extension alone does not establish that a partner was compromised. The company noted that the extensions provide an API capable of executing remote commands, protected by a passphrase configured at setup.

The Hacker News reported on November 12, 2026, that the activity was first detected at around 17:47 UTC on November 11. The attack runs in two stages. A compromised panel's Run Command feature deploys a rogue ScreenClient across endpoints, creating a backdoor independent of the original panel. When a technician connects to an infected endpoint, the malware spreads back to their workstation, steals saved browser sessions and authentication tokens, and pivots to other panels the technician can reach. The rogue clients deliver SCKit, which establishes persistent remote access and a relay trap for intercepting session cookies, adds Defender exclusions, installs a second attacker controlled ScreenConnect client, creates a scheduled task named TrapWatch running as SYSTEM, and replaces the legitimate ScreenConnect installation.

Analysis

The technical story is less about a single bug than about a chain of small trusts. RMM+ exists so that partners can manage sessions without re-entering credentials, and it is protected by a passphrase chosen at setup. When that passphrase is never set, the extension's own convenience becomes the weakness. The Huntress finding that a blank key was accepted by versions 1.0.31 and 1.0.32 is the hinge on which the rest of the intrusion turns. The attacker did not need to defeat ScreenConnect authentication because a companion tool quietly agreed to skip it.

What this really means is that third-party extensions sit inside the security boundary of the platforms they extend, whether or not vendors, partners or auditors treat them that way. ConnectWise was careful to say it found no compromise of its own infrastructure and no vulnerability in ScreenConnect itself. That statement may be accurate and still miss the operational point. For a managed service provider, an extension running with command execution rights is part of the product surface, and an ecosystem of roughly 400 partner environments is a shared neighborhood rather than a set of isolated tenants.

The speed is the other half of the story. Reaching 288 hosts in about 90 minutes is not the profile of intruders working patiently through a target list; it is automation riding an already trusted channel. The actor tagged each compromised MSP with a sequential number, and the observed tags started partway through the sequence, which suggests other MSPs may have been hit earlier. That detail, reported by The Hacker News on November 12, 2026, is the kind of clue that usually means an incident is larger than its first public estimate.

There is also the model signature. Huntress said there are signs that at least one script was generated by a large language model, according to The Hacker News. That does not change the mechanics of the intrusion, but it lowers the skill floor for producing tooling that looks purpose-built. Defenders should expect more campaigns in which the expensive part is access and the cheap part is code, with the same reusable components reappearing across unrelated victims.

Why It Matters

For MSPs, the blast radius is structural. A single technician workstation can hold sessions into dozens of customer environments, and the SCKit design targets exactly that. It waits for a technician to connect to an infected endpoint, infects the workstation, harvests browser sessions and tokens, then moves to other panels the technician can access. The customer list of one provider is effectively the target list of every provider it shares tooling and staff with.

ConnectWise's warning that disabling extensions and resetting credentials alone may not remove unauthorized software, persistence mechanisms or access already established on endpoints is the operational core of the advisory. Cleanup is not a configuration rollback. The published indicators include the IP addresses 185.99.255.28 and 155.94.150.39, the domains ns.mo7sen.dev and sc.payproofkit.com, the files sckit-run.bat, sckit-decoder.ps1 and TrapWatch.ps1, a persistence directory at C:\ProgramData\RelayTrap\, a scheduled task named TrapWatch running as SYSTEM, and the rogue ScreenConnect client IDs 2588ef5c15954b10 and ed630cc2c873b091.

Sophos X-Ops reported on November 12, 2026, that its researchers were investigating an active campaign of unauthorized ScreenConnect client deployments following the same modus operandi. In one case, curl.exe downloaded ScreenConnect.ClientSetup.msi from 185.99.255.28 to C:\Windows\TEMP\sc.msi, and a ScreenConnect generated command file launched msiexec.exe to install the client silently. Sophos also observed scripts staging batch files and using PowerShell with execution policy bypass to retrieve a second stage script from ns.mo7sen.dev/EadF.php?p=4. It traced the activity to three instance IDs, d905b2b1b165d0a9, 4b8f4089ddaac6a9 and df1f7ef0cfacd0d8, which are likely compromised instances used to execute commands and deploy malicious instances with IDs 2588ef5c15954b10 and ed630cc2c873b091.

Next Up

The immediate work is forensic and unglamorous. Sophos recommended that organizations follow the ConnectWise advisory, review ScreenConnect command history for unexpected client deployments or remote commands, and investigate curl and PowerShell activity that downloads ScreenConnect installers or scripts into Windows Temp followed by msiexec.exe installation. Partners that ran any of the five extensions should assume nothing about their current state until they have checked for the named files, the RelayTrap directory and the TrapWatch scheduled task, and until they have hunted for rogue clients rather than merely removing the plugin.

The larger question is scope and disclosure. ConnectWise said the initial access method and full scope remain under investigation, and Huntress told The Hacker News it had not seen evidence of a new vulnerability, with telemetry pointing instead to compromised credentials or hijacked operator sessions. Until those threads are reconciled, the count of 288 endpoints and 48 organizations should be read as a floor rather than a final tally.