Rogue Remote-Access Clients Are Spreading Through IT Providers’ ScreenConnect Panels. ConnectWise Has Switched Off Five Extensions
Attackers with access to IT providers’ cloud-hosted ScreenConnect panels are pushing their own remote-access clients onto customer computers. Huntress counts at least 288 endpoints across 48 organizations, and ConnectWise has disabled five third-party extensions in about 400 partner environments as a precaution.
An active attack campaign is running through one of the tools IT service providers rely on most: the remote support console. Attackers who got into managed service providers’ cloud-hosted ScreenConnect panels have been using them to install their own copies of the ScreenConnect client on customer computers, giving themselves a way back in that no longer depends on the provider’s console at all.
The details below come from BleepingComputer’s reporting on the ScreenConnect attacks, together with The Hacker News, which summarized ConnectWise’s advisory and Huntress’s analysis.
What has been confirmed
- When it started: Huntress says the activity began around 17:47 UTC on November 11 (about 12:47 p.m. Eastern) and targets cloud-hosted ScreenConnect instances.
- Scale so far: Huntress first reported six compromised MSPs and more than 286 endpoints; its later count was at least 288 endpoints across 48 organizations, and it warned the numbers were still climbing.
- Method: The attackers use ScreenConnect’s Run Command feature to push rogue clients onto managed machines. Huntress describes it as misuse of legitimate functionality, helped along by custom tooling, rather than a new software vulnerability.
- Vendor response: ConnectWise confirmed unauthorized access to partner accounts and disabled five independent third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link) across roughly 400 partner environments as a precaution. It says it has no evidence its own infrastructure was compromised.
- Other sightings: Sophos separately reported unauthorized ScreenConnect client installs following the same pattern.
What is still unknown
- How the attackers first got into the provider panels. Huntress says its telemetry points toward stolen credentials or hijacked operator sessions, and ConnectWise says the initial access method is still under investigation.
- How many providers were hit before anyone noticed. Huntress says the attacker numbers each compromised MSP in sequence, and the tags it has seen start partway through, which suggests earlier victims.
- Whether the jump back to technicians actually works in the wild. ConnectWise says it has received reports of technician workstations being compromised during live sessions but is still confirming them, and Huntress says it has reconstructed that capability from the malware rather than watched it succeed.
Why the two-stage design worries defenders
According to Huntress, the rogue clients deliver a toolkit it calls SCKit. Stage one plants a backdoor on customer endpoints. Stage two is the part that turns a single incident into a chain: when a technician opens a remote session to an infected machine, the malware is built to reach back to that technician’s workstation, take the browser session cookie for the ScreenConnect panel, and use it to push a payload to every other machine the technician can reach. Components also add Microsoft Defender exclusions and set up a scheduled task for persistence. Huntress noted that at least one script shows signs of having been written with the help of an AI model.
ConnectWise’s own advice reflects that risk: do not open interactive ScreenConnect sessions to devices you suspect are compromised, and investigate them with separate security tools instead.
Checks to run today
- If you are an IT provider with an on-premises ScreenConnect server, disable the five extensions yourself; ConnectWise can only switch them off in its cloud. Do not reinstall them until the vendor says it is safe.
- Review Run Command history, Toolbox activity, extension installs, administrator changes and sign-in logs, even if no alert has fired.
- Look for ScreenConnect clients on endpoints that do not belong to your own instance, and compare against the indicators published by ConnectWise and Huntress.
- Remember that disabling an extension does not remove anything the attacker already installed. Affected endpoints need a proper investigation.
- Watch for unusual sign-ins, unexpected MFA prompts, new admin accounts and unexpected support or password-reset requests that arrive through trusted channels.
What this means for your company
Even if you never log in to a remote support tool yourself, someone almost certainly can reach your computers through one. That access is a convenience and a risk at the same time. It is worth asking your IT provider, or your internal team, which remote access tools are installed on your machines, who can use them, whether those accounts require strong multifactor authentication, and how quickly an unknown remote-access client would be noticed. A second layer of endpoint monitoring that does not depend on the remote support platform is what lets you spot a rogue client when the console itself has been turned against you.
Not sure who has remote access to your computers today, or how you would know if that changed? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
