Attackers exploit third-party ScreenConnect plugins to plant persistent malware across dozens of companies

Cybercriminals have compromised at least 288 endpoints across 48 organizations by targeting ScreenConnect installations with malicious commands, according to security firm Huntress. Attackers used the access to deploy a 16-file toolkit dubbed SCKit, which establishes secondary ScreenConnect instances to maintain control even if original connections are closed. [1][2]

Investigators tracked the intrusion to an authentication weakness in the third-party RMM+ extension family, specifically versions 1.0.31 and 1.0.32, which allow command execution without multi-factor authentication if access keys are left unconfigured. The vulnerability affected ScreenConnect versions 26.6.6.9747 and 26.7.6.9783. ConnectWise stated it has found no evidence of flaws in its own core software or infrastructure, but warned that disabling plugins and resetting credentials will not eliminate persistence mechanisms already installed by attackers. [1][2]

The malware also attempts to booby-trap compromised endpoints, trying to steal credentials and infect technicians who connect through ScreenConnect to investigate. Huntress noted that these lateral takeover attempts have failed in every examined log so far, but both ConnectWise and Huntress are urging administrators to avoid using ScreenConnect to review suspected hosts so they do not risk exposing their own systems. [1]