MeridianMeridian

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has disabled five third-party extensions after reports of unauthorized access to partner environments. The company found no evidence of compromise to its own infrastructure or vulnerabilities in ScreenConnect software. Huntress observed attackers using compromised panels to deploy rogue clients, infecting 288 endpoints across 48 organizations. The attack spreads in a worm-like manner from endpoints to technician workstations and then to additional panels. SCKit toolkit establishes persistence, steals session cookies, and relays commands through the Shared Toolbox feature. Sophos confirmed similar activity originating from three specific ScreenConnect instance IDs. Partners are advised to review Run Command history and monitor for unusual logins and extension activity.

The Hacker NewsTranslated from English

Read at source

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access to ScreenConnect panels.

In an advisory, the company stated there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. Initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments.

ConnectWise has identified about 400 partner environments with at least one of the third-party extensions installed. The list of extensions identified for precautionary disabling includes Labtech Plus, RMM Plus, RMM+ Password Link, and RMM Plus Password Link.

Huntress observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands with an aim to install rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The activity was first detected on November 11, 2026.

The overall attack unfolds in a worm-like fashion using a two-step process involving initial access via compromised credentials or hijacked operator sessions and lateral movement that spreads back to technician workstations.

The rogue clients deliver SCKit, a custom malicious toolkit that establishes persistent remote access and creates a relay trap for intercepting session cookies. Components include sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, and ToolboxRelayUploader.exe.

Sophos confirmed similar unauthorized ScreenConnect client deployments originating from three instance IDs: d905b2b1b165d0a9, 4b8f4089ddaac6a9, and df1f7ef0cfacd0d8.

HuntressConnectWiseScreenConnectSophosSCKit
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

eBPF Rootkits Spread Underground with Code for Stealthy Linux Implants
Malware & Botnets

eBPF Rootkits Spread Underground with Code for Stealthy Linux Implants

eBPF technology, long praised for legitimate Linux kernel observability and networking, is now being weaponized by underground actors to create rootkits that evade traditional detection. Flare research uncovered Russian-language forum posts on Duty Free sharing full source code and tutorials for implants that hide processes via getdents64 hooks, activate via crafted TCP SYN packets, and encrypt C2 traffic with AES-256-GCM. Historical examples include BPFDoor used by Red Menshen, Symbiote’s dynamic linker preload technique, and the more recent LinkPro discovered by Synacktiv after a Jenkins compromise. Public research tools such as ebpfkit, TripleCross, and Boopkit demonstrated the same capabilities years earlier at Black Hat and DEF CON. Defenders are advised to restrict unprivileged BPF access, regularly audit programs with bpftool, and monitor for unexpected XDP attachments and magic packets.

BleepingComputerNov 11, 2026Translated from English

Blind Eagle APT-C-36 Resurfaces with Judicial-Themed Phishing Delivering AsyncRAT-DCRat Hybrid RAT Across Latin America
Malware & Botnets

Blind Eagle APT-C-36 Resurfaces with Judicial-Themed Phishing Delivering AsyncRAT-DCRat Hybrid RAT Across Latin America

The threat actor known as Blind Eagle has launched a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan that shares its lineage with AsyncRAT and DCRat. The campaign uses Portuguese and Spanish lures resembling court notifications, fiscalía notices, tutela proceedings, and administrative documents. Attack chains begin with phishing emails containing weaponized XHTML files that render as SVG images impersonating Colombia's Fiscalía General de la Nación. The page employs HTML smuggling with ZipCrypto to assemble a ZIP archive payload locally in the browser. Inside the archive is a JavaScript dropper that performs environment reconnaissance before launching a VBScript to bypass AMSI and ETW, display a fake criminal-citation page, and establish persistence. The final payload is an AsyncRAT fork with DCRat lineage decoded and executed in memory via PowerShell, enabling reconnaissance, document collection, keystroke logging, screen capture, and encrypted data exfiltration.

The Hacker NewsNov 10, 2026Translated from English

Russian Cloud Provider Beget Rebuilds Infrastructure from Scratch Following Destructive Data Wiper Attack
Malware & Botnets

Russian Cloud Provider Beget Rebuilds Infrastructure from Scratch Following Destructive Data Wiper Attack

A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its entire cloud infrastructure from scratch after attackers gained access to management systems on November 1st. The company detected the intrusion shortly after the malware activated and immediately disconnected all servers from the network to contain the spread. Beget, which serves more than 200,000 customers including online stores, media, and educational services, reported that all data in its cloud infrastructure including VPS, S3, and Kubernetes was lost along with CDN settings and IP configurations. VPS binary backups were completely destroyed while file backups survived only partially and will be available for roughly half of VPS users after technically complex matching processes. The firm is manually checking around 1,000 servers for vulnerabilities and hidden scripts, treating all infrastructure as potentially infected, and has notified police and government agencies while collaborating with cybersecurity firms. Recovery efforts have restored 60% of shared hosting and 40% of dedicated servers more than a week after the incident, with the attack focused solely on destruction rather than data theft.

BleepingComputerNov 9, 2026Translated from English