RMM+

Threat Actors Deploy SCKit Malware Toolkit Through Compromised ConnectWise ScreenConnect Panels

A threat actor compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a coordinated campaign reported by Huntress. The attacks began on November 11 when unauthorized access to cloud-hosted ScreenConnect panels was used to execute commands on managed endpoints. At least six managed service providers and 288 hosts across 48 organizations were affected, with all compromised hosts hit within a 90-minute window. Attackers deployed rogue ScreenConnect clients along with the SCKit malware toolkit, which establishes persistent backdoor access, intercepts session cookies, and attempts self-replication by infecting technician workstations. The campaign exploited an authentication flaw in the third-party RMM+ extension for ScreenConnect versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank. ConnectWise responded by disabling five related extensions across approximately 400 environments, and both Huntress and ConnectWise released indicators of compromise.