Hackers Deploy Malware in Fresh ScreenConnect Campaign
A threat actor has compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a fresh campaign observed on November 11.
The attackers abused unauthorized access to cloud-hosted ScreenConnect panels to run commands on managed endpoints, deploying rogue clients and a malware toolkit called SCKit that provides persistent backdoor access.
Scale of Attack
According to Huntress, the campaign compromised at least 6 managed service providers and 288 hosts across 48 organizations. The attackers hit all 288 compromised hosts within 90 minutes.
Exploited Vulnerability
The hackers exploited a vulnerability in RMM+, a third-party extension for managing ScreenConnect sessions. Versions 1.0.31 and 1.0.32 contained a serious authentication flaw where the access key defaulted to blank if not configured.
Their presence alone does not establish compromise. These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup.
Company Response
ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments, including Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.
Both Huntress and ConnectWise have released indicators of compromise (IoCs) associated with the campaign and recommend that organizations disable the extensions in their on-premises ScreenConnect deployments.
Related
