ScreenConnect Attacks Target 288 Endpoints Across 48 Organizations
A new cyberattack campaign is targeting ConnectWise ScreenConnect environments, allowing attackers to install unauthorized remote-access software on managed devices.
According to cybersecurity firm Huntress, at least 288 endpoints across 48 organizations were affected during a 90-minute period on November 11, 2026.
How the Attack Works
Attackers are abusing ScreenConnect’s remote command capabilities to deploy rogue clients and a malicious toolkit called SCKit.
The toolkit is designed to:
- Establish persistent remote access to infected devices.
- Steal authentication tokens and session cookies.
- Attempt to spread through technician workstations.
- Deploy additional malicious software across connected systems.
Researchers have confirmed unauthorized client deployments but have not observed successful technician-to-endpoint propagation through the toolkit’s additional lateral movement capabilities.
ConnectWise Responds
ConnectWise has precautionarily disabled five third-party extensions, including RMM Plus and Labtech Plus, across approximately 400 partner environments.
The company reports no evidence of a compromise of its infrastructure or that initial access involved a ScreenConnect vulnerability. The investigation remains ongoing.
Recommended Security Actions
Organizations using ScreenConnect should:
- Verify that the affected third-party extensions are disabled.
- Review remote command history and administrator activity.
- Investigate unfamiliar ScreenConnect clients and unauthorized installations.
- Revoke suspicious sessions and secure administrator credentials.
- Monitor endpoints for unusual activity and preserve relevant logs.
Remote management tools require strong security controls. Regular monitoring, access reviews, and endpoint protection can help organizations identify suspicious activity before it spreads.
Britec helps businesses strengthen cybersecurity and protect their IT environments.
