ConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users - Cybersecurity Dive
ConnectWise is investigating a cyberattack targeting ScreenConnect users, having disabled third-party extensions in about 400 environments as a precautionary measure.
ConnectWise is investigating reports that a threat actor is manipulating third-party extensions in ScreenConnect environments to execute malicious remote commands against end users. The company has disabled access to RMM+ extensions at approximately 400 environments as a precautionary measure.
While the initial access method remains unconfirmed, ConnectWise's initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments. The company advises on-premises partners to disable their third-party extensions as it cannot take unilateral action in those instances.
Attack Details
Huntress, a Maryland-based cybersecurity firm, reported that an attacker has installed rogue ScreenConnect clients on at least 288 managed endpoints across 48 different organizations. The rogue client then installs a malicious toolkit called SCKit into those environments.
The attacker is abusing ScreenConnect to establish persistent remote access on victim environments and install malware that could potentially steal session cookies.
The attacker uses the ScreenConnect Run command to deploy the malicious toolkit. SCKit contains a package of 16 files, including PowerShell scripts, batch scripts, and Windows command line files to allow the infection to spread in a multistage process.
Security Response
ConnectWise recommended partners take immediate steps to secure their environments, including confirming that third-party extensions are disabled and using separate tooling to investigate suspected compromises. The company specifically advised against using interactive ScreenConnect sessions for investigations.
Partners should secure administrative access from a trusted device, revoke active ScreenConnect sessions, revoke passwords, and implement multifactor authentication. They should also preserve evidence including authentication records, extension installation logs, Run command history, and Toolbox records.
Researchers at BlackPoint claim the toolkit uses a Relay/Trap component targeting technicians who might attempt to connect to affected machines, which they associate with a previously disclosed vulnerability (CVE-2026-84869). The Cybersecurity and Infrastructure Security Agency added this flaw to its Known Exploited Vulnerabilities catalog in September.
Related
