ConnectWise disables five ScreenConnect extensions after rogue client access

ConnectWise disabled five third-party ScreenConnect extensions in partner environments after rogue clients accessed at least 288 endpoints across 48 organizations, activity first detected Nov. 11, 2026, around 5:47 p.m. UTC. Huntress detected the suspicious activity that evening.

The company named Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link as the disabled extensions. ConnectWise said about 400 partner environments had one or more of the extensions installed, but installing the extensions does not necessarily compromise a network.

ConnectWise said there is no evidence the incident compromised its infrastructure or involved a vulnerability in ScreenConnect software. Huntress said it has seen no evidence of a new vulnerability, and the exact method the attacker used to enter panels remains unclear.

Huntress said attackers used access to cloud-hosted ScreenConnect panels to issue Run commands that placed rogue clients on at least 288 endpoints at 48 organizations. The company observed all 288 affected hosts across 90 minutes, with about one third hit during the first 10 minutes, and initially identified six compromised MSPs and counted 286 affected endpoints at 47 organizations, noting the victim count was rising.

The two-stage infection path moves from an infected endpoint to a technician’s workstation, then to other endpoints reachable through that technician’s ScreenConnect panel. Huntress rebuilt code to spread from a technician’s computer to the ScreenConnect panel, but researchers have seen no jump from endpoint to workstation.

“The rogue clients deliver SCKit, a custom malicious toolkit that establishes persistent remote access and creates a relay trap for intercepting session cookies,” Huntress researchers Ben Nahorney and Susannah Matt said. A Base64-encoded dropper called sckit-run.bat delivers SCKit as an encrypted payload and retrieves sckit-decoder.ps1 to start the toolkit.

Huntress said malware components add Microsoft Defender exclusions, push out a second ScreenConnect client controlled by attackers, create a TrapWatch task, and swap the legitimate installation for an attacker-controlled copy. The design pulls Run-Lateral-Full.bat from ns[.]mo7sen[.]dev, downloads a loader that gathers the workstation ID, and sends back a customized encrypted kit for that machine.

Huntress said Panel-Lateral.ps1 together with LabConfig.ps1 takes the .aspxauth session cookie from the workstation and attempts to replay it against the panel to list technician sessions. ToolboxRelayUploader.exe uploads WithUninstall.ps1 to the panel’s Shared Toolbox, and a panel request directs all reachable sessions to run the toolbox item as SYSTEM. The uploader removes the Shared Toolbox item roughly 60 seconds after the broadcast.

Sophos saw unauthorized ScreenConnect client deployments using the same methods from three instance IDs suspected to be compromised: d905b2b1b165d0a9, 4b8f4089ddaac6a9 and df1f7ef0cfacd0d8. Those suspected compromised instances rolled out more malicious instances with the IDs 2588ef5c15954b10 and ed630cc2c873b091.

Sophos reported that Curl.exe grabbed ScreenConnect.ClientSetup.msi from 185.99.255[.]28 and placed it at C:\Windows\TEMP\sc.msi, and a command file generated by ScreenConnect ran msiexec.exe to carry out a silent client installation. Researchers saw ScreenConnect scripts stage batch files and use PowerShell with execution-policy bypass to pull a second-stage script from ns[.]mo7sen[.]dev/EadF.php?p=4.

Huntress and ConnectWise listed attacker infrastructure, including the IP 185.99.255[.]28 and the domain ns[.]mo7sen[.]dev. Other indicators include the domain sc.payproofkit[.]com at IP 155.94.150[.]39 and the domains newnewnew.gotdns[.]org and soxnewwork.homedns[.]org. Malware artifacts spotted include sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, Panel-Lateral.ps1, Run-Lateral-Full.bat, runnew.cmd, ToolboxRelayUploader.exe and Sqlite3.exe.

ScreenConnect users should check Run Command history even without receiving alerts.

ConnectWise said investigators have not yet identified how attackers gained access or the full extent, while Huntress ties the activity to RMM+. Huntress also said the activity appears related to the RMM+ extension. RMM+ versions 1.0.31 and 1.0.32 accepted a blank access key if never configured, bypassing ScreenConnect accounts, roles and multifactor authentication.

Huntress said current telemetry indicates that compromised credentials or seized operator sessions provided initial entry. The company also says signs point to at least one script generated by a large language model based on detailed source code references and comments.

ConnectWise patched the critical file-transfer flaw CVE-2026-84869 in ScreenConnect client version 26.6.5 and later. ConnectWise warned customers on Sept. 3 that files could move and run through active remote sessions without authorization and told admins to remove the TransferFiles permission from users with open sessions.

A nation-state attack in May 2025 affected several customers but caused no customer loss, ConnectWise said, and the company put out a ScreenConnect patch in 2024 after reports that attackers exploited the product.

BleepingComputer found a VirusTotal batch script from July 25, 2026, named SSA-2026-STATEMENT-15518787.bat that references rogue client ID ed630cc2c873b091. The script added Microsoft Defender exclusions and created persistence through the Startup folder and the Run registry key. It reached out to amexsafekeyupdate.com and searched processes and services for ed630cc2c873b091. After launching the second installer, the July script used PowerShell to look for ed630cc2c873b091 and sent a Telegram alert to attackers if found.

Huntress set up a Rapid Response in September 2026 for similar worm-like activity that spawned rogue ScreenConnect clients across many customer environments. The company declined to comment on the July incident but noted a significant increase in 2026 attacks using legitimate RMM software as an initial payload, and said the relationship between the July malware activity and current ScreenConnect attacks remains unclear.

Researchers with Huntress reached out to ConnectWise, the VPS provider hosting attacker infrastructure, cloud providers with dynamic DNS services, and the wider MSP community.

Huntress said ScreenConnect users should review Run Command and Toolbox history for unrecognized executions and check whether managed endpoints run a second unauthorized ScreenConnect client. Technicians who connected to a suspected host should treat the workstation as potentially exposed and investigate from an unaffected device.

Huntress said using an unaffected device, end active ScreenConnect web sessions, rotate affected credentials, and revoke browser and identity-provider sessions that may have been exposed. Researchers saw affected systems become reinfected shortly after isolation ended, so before a host goes back into service, remove the rogue client and persistence, then confirm reinfection has not happened.

ConnectWise said extension removal is only containment and does not remove malware, persistence, or access attackers may already have established on compromised endpoints.

ScreenConnect is a remote access and support platform that MSPs and IT teams use to manage and troubleshoot customer devices. They add extensions through the built-in Extensions marketplace in the ScreenConnect administration interface. Huntress said the third-party RMM+ extension lets another tool manage sessions without using the technician console, and most RMM+ installations it observed were legitimate, usually added for a project and then left alone.