Threat Actors Deploy SCKit Malware Toolkit Through Compromised ConnectWise ScreenConnect Panels

A threat actor compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a coordinated campaign reported by Huntress. The attacks began on November 11 when unauthorized access to cloud-hosted ScreenConnect panels was used to execute commands on managed endpoints. At least six managed service providers and 288 hosts across 48 organizations were affected, with all compromised hosts hit within a 90-minute window. Attackers deployed rogue ScreenConnect clients along with the SCKit malware toolkit, which establishes persistent backdoor access, intercepts session cookies, and attempts self-replication by infecting technician workstations. The campaign exploited an authentication flaw in the third-party RMM+ extension for ScreenConnect versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank. ConnectWise responded by disabling five related extensions across approximately 400 environments, and both Huntress and ConnectWise released indicators of compromise.

SecurityWeekNovember 12, 2026Translated from English

Read at source

A threat actor has compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a fresh campaign, cybersecurity outfit Huntress reports.

The attacks were observed on November 11, when the hackers abused their unauthorized access to cloud-hosted ScreenConnect panels to run commands on managed endpoints. According to Huntress, the campaign compromised at least 6 MSPs and 288 hosts across 48 organizations. The attackers hit all 288 compromised hosts within 90 minutes.

The attackers’ commands deployed rogue ScreenConnect clients and a malware toolkit called SCKit that provides persistent backdoor access, intercepts session cookies, and can self-replicate. Initially deployed via ScreenConnect panels, it waits for a technician to connect to the compromised endpoint to infect their workstation. Next, it attempts to compromise other sessions the technician has access to and spread itself to other panels.

“However, not all functionality has been observed during observed incidents; some functionality has been discovered through analyzing the payloads,” Huntress says.

As part of the attacks, the hackers exploited a vulnerability in RMM+, a third-party extension for managing ScreenConnect sessions that uses a shared access key to bypass ScreenConnect’s authentication mechanism. The hackers likely exploited a bug in the extension’s versions 1.0.31 and 1.0.32, where the access key defaults to blank if not configured, thus allowing an attacker to bypass authentication with an empty value.

“Our analysis suggests that most RMM+ installations we encountered were legitimate, usually added for a project and left in place. But versions 1.0.31 and 1.0.32 contained a serious authentication flaw: if an administrator had never configured the extension’s access key, RMM+ would accept a blank one,” Huntress says.

The cybersecurity firm says its investigation determined that commands reached endpoints within minutes. However, there was no corresponding login activity, and the reviewed logs were linked to RMM+ instead. In response, ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.

“Their presence alone does not establish compromise. These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup,” ConnectWise notes.

Both Huntress and ConnectWise have released indicators of compromise (IoCs) associated with the campaign and recommend that organizations disable the extensions in their on-premises ScreenConnect deployments.

Huntress ConnectWise ScreenConnect SCKit RMM+

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

Malware & Botnets

Threat Actors Abuse Legitimate GSocket Tool for Stealthy Persistent Access on Linux Servers

Multiple threat actors have been observed abusing the open-source GSocket remote access tool to maintain long-term access to compromised Linux servers, even after initial vulnerabilities are patched. The tool enables attackers to bypass firewalls and NAT by routing traffic through the Global Socket Relay Network, where both the compromised host and the attacker initiate outbound connections. Microsoft Defender for Endpoint telemetry recorded a 356.2% increase in GSocket-related detections between March and August, with 87.1% of incidents targeting web applications and hosting environments. Attackers disguise GSocket as kernel threads and establish persistence via cron jobs, systemd services, and shell startup files. In some cases, they attempted to exploit the Dirty Frag Linux kernel vulnerability CVE-2026-43284 to escalate privileges. Most affected organizations belong to the education, research, technology, manufacturing, and government sectors. Defenders are advised to remove GSocket artifacts, restrict outbound traffic, and audit persistence mechanisms.

BleepingComputerNov 12, 2026Translated from English

Malware & Botnets

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has disabled five third-party extensions after reports of unauthorized access to partner environments. The company found no evidence of compromise to its own infrastructure or vulnerabilities in ScreenConnect software. Huntress observed attackers using compromised panels to deploy rogue clients, infecting 288 endpoints across 48 organizations. The attack spreads in a worm-like manner from endpoints to technician workstations and then to additional panels. SCKit toolkit establishes persistence, steals session cookies, and relays commands through the Shared Toolbox feature. Sophos confirmed similar activity originating from three specific ScreenConnect instance IDs. Partners are advised to review Run Command history and monitor for unusual logins and extension activity.

The Hacker NewsNov 12, 2026Translated from English

Malware & Botnets

eBPF Rootkits Spread Underground with Code for Stealthy Linux Implants

eBPF technology, long praised for legitimate Linux kernel observability and networking, is now being weaponized by underground actors to create rootkits that evade traditional detection. Flare research uncovered Russian-language forum posts on Duty Free sharing full source code and tutorials for implants that hide processes via getdents64 hooks, activate via crafted TCP SYN packets, and encrypt C2 traffic with AES-256-GCM. Historical examples include BPFDoor used by Red Menshen, Symbiote’s dynamic linker preload technique, and the more recent LinkPro discovered by Synacktiv after a Jenkins compromise. Public research tools such as ebpfkit, TripleCross, and Boopkit demonstrated the same capabilities years earlier at Black Hat and DEF CON. Defenders are advised to restrict unprivileged BPF access, regularly audit programs with bpftool, and monitor for unexpected XDP attachments and magic packets.

BleepingComputerNov 11, 2026Translated from English