Active Campaign Exploits ScreenConnect Partner Environments
ConnectWise is investigating unauthorized access to some ScreenConnect partner environments. Huntress recorded at least 288 affected hosts across 48 organizations.
The ScreenConnect campaign is exploiting some managed service provider (MSP) partner environments. ConnectWise confirmed reports of unauthorized access and the deployment of unauthorized remote access software at customer sites. The company also says it has no evidence so far of a compromise of its own infrastructure or a vulnerability in the ScreenConnect product itself.
According to telemetry from security firm Huntress, at least 288 hosts across 48 organizations using its service were affected. These figures do not represent the full scope of the incident, but they confirm that this is an active campaign affecting MSP environments and their customers.
The ScreenConnect Campaign Uses Remote Commands
Huntress said the attacker used the Run Command feature in compromised environments. Through it, the attacker deployed rogue ScreenConnect clients and the SCKit tool.
ConnectWise proactively disabled five independent extensions in approximately 400 partner environments. However, the presence of such an extension or the number of affected environments alone does not mean that all of them were compromised. This is a precautionary measure during the investigation.
The company preliminarily links the activity to the exploitation of independent extensions. Huntress specifically attributes the incident to an authentication flaw in the RMM+ extension in versions 1.0.31 and 1.0.32 when an access key was not configured. ConnectWise has not confirmed this specific cause in its current advisory.
Risk to MSPs and Their Customers
MSPs manage the devices and systems of multiple customers, often with privileged access. A compromised panel could allow an attacker to deliver remote access in bulk to customer-managed devices.
The case also does not represent a confirmed exploit of the ScreenConnect core. Available findings point to the exploitation of access in partner environments and a possible role of a third-party extension. The initial access vector, the attacker’s identity, the total number of affected MSPs and organizations, and the overall scope of the incident remain unverified.
Huntress also analyzed the ability of the SCKit tool to spread from an infected endpoint through technicians’ devices to additional systems. According to the company, this mechanism exists, but it has not observed its successful use in the cases currently being monitored.
Recommended Steps for ScreenConnect Administrators
ConnectWise recommends disabling the affected extensions, terminating active sessions, changing relevant passwords, and reviewing multifactor authentication settings. Administrators should also check logs for unusual commands, sessions, and installations of remote access tools.
Suspicious devices should be isolated and checked for signs of persistence or additional unauthorized software. Disabling the extension alone may not remove access already established by the attacker or persistence.
Further investigation should clarify the initial vector and the role of RMM+, and disclose any new indicators of compromise or eradication guidance. It will also be important to determine whether propagation through technicians’ workstations or the subsequent deployment of additional malware is confirmed.
Sources
- ConnectWise Trust Center — ScreenConnect security advisory – Confirms the investigation into unauthorized access, the precautionary disabling of five extensions in approximately 400 environments, the lack of evidence of a ScreenConnect flaw, and measures for partners.
- Huntress — SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints – Documents Huntress’s telemetry on at least 288 hosts across 48 organizations, the use of Run Command, and technical findings about SCKit and RMM+.
- BleepingComputer — Active ScreenConnect attacks breach MSPs, impact dozens of organizations – Independently summarizes the active campaign, ConnectWise’s response, and warnings for MSPs.
Verified and updated: 11/12/2026 06:25
