Image: ScreenConnect (ConnectWise) — official logo, via Wikimedia Commons, CC BY-SA 4.0
📌 Key Highlights
- Huntress first spotted the campaign at about 17:47 UTC on 11 November 2026: six compromised MSPs, 286+ affected endpoints across 47 organisations, with the count still rising.
- Attackers abused ScreenConnect's legitimate Run Command feature — no ScreenConnect vulnerability has been blamed, and ConnectWise says it has found no evidence its own infrastructure was compromised.
- ConnectWise disabled five third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) across about 400 partner environments as a precaution.
- Researchers later identified the SCKit toolkit and its "RelayTrap" trick, which targets the technician connecting to an infected machine — blocked by the ScreenConnect client fix in version 26.6.5.
- Resetting passwords does not remove a rogue client: it reports to attacker-controlled servers and survives a clean-up of the MSP's account.
ScreenConnect MSP attacks November 2026: what happened
ScreenConnect is the remote-access platform many managed service providers (MSPs) — the outside IT firms that look after computers for small and mid-sized businesses — use to fix customer machines from afar. On Wednesday 11 November 2026, security firm Huntress warned that attackers had got into the cloud-hosted ScreenConnect environments of six MSPs and were using them against the MSPs' own customers.
Once inside a provider's ScreenConnect panel, the attackers used its built-in Run Command feature to install a second, rogue ScreenConnect client on each managed computer. That second client does not report to the IT provider. It reports to servers the attackers control, giving them a separate remote-access channel into the customer's machine — one that survives even if the provider resets its passwords and cleans up its own account. Huntress was tracking six compromised MSPs and more than 286 affected endpoints across 47 organisations when BleepingComputer reported the campaign, and later counts put it at at least 288 endpoints across 48 organisations. The numbers were still rising.
How the attackers got into the MSP panels in the first place is still not confirmed. Huntress says its telemetry points to compromised credentials and hijacked MSP support sessions. ConnectWise's initial assessment is that the attacker may have abused independent third-party extensions installed in partner environments, and it says a CVE has been assigned to the issue in the third-party extension. Huntress linked the activity to the RMM+ extension, reporting that versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator had never set one. ConnectWise stresses that having one of the named extensions installed does not by itself mean a partner was hit.
How the rogue clients spread — and the SCKit trap for technicians
The attack works because it abuses a trusted tool rather than breaking it. A rogue ScreenConnect client looks much like the real one, so it can sit unnoticed on a machine for months. Huntress also warned of a reverse risk: a technician who opens an interactive ScreenConnect session to an already-infected customer computer could have their own workstation compromised through that session.
Analysis published on 12 November by Blackpoint Cyber's Adversary Pursuit Group, alongside Huntress's own analysis, gave that warning a name: SCKit, a custom toolkit the rogue clients deliver. Its "RelayTrap" component waits on the infected customer machine and tries to compromise the technician who connects, including by stealing the technician's session cookie. ConnectWise says the endpoint-to-technician spread technique is blocked by the fix for CVE-2026-84869, released in ScreenConnect client version 26.6.5 on 8 September 2026 — so updating Host and Guest clients to 26.6.5.9742 or later is one of the most important steps for any MSP still running older clients.
There is also a hint that this campaign did not start on 11 November. The attackers tagged each compromised MSP with a sequential number, and the tags Huntress observed started partway through the sequence — suggesting other MSPs may have been hit earlier without noticing. BleepingComputer separately found a malicious script from July 2026 referencing one of the rogue client IDs, though the link between that script and the current campaign is unclear. No ransomware has been tied to this wave so far, and what the attackers did next on the infected machines has not been reported.
Illustrative image: an IT help desk — the kind of support team that manages customer machines through tools like ScreenConnect. Image: Wikimedia Commons.
Why it matters for readers in India
This is a supply-chain attack in the plainest sense: the attacker does not need to break into your business, because it can log in through the people you already trust with your computers. Indian businesses of every size outsource IT to MSPs, and Indian MSPs themselves use ScreenConnect — so a compromised provider anywhere in the chain can put its customers' machines at risk, whatever country they sit in.
The timing adds to the concern. This is the second time in a week that the remote-management software MSPs rely on has been turned against them: researchers disclosed 33 alleged flaws in N-able N-central, known as Able2Shell, on 9 November, and N-able took its hosted environments offline while it shipped a hotfix. Read our explainer on the N-able N-central Able2Shell flaws. A similar actively exploited login bypass in Xen Orchestra was confirmed the same week. If you run any remote-management tool, this is the week to check it — not next quarter.
ScreenConnect attacks: the key facts at a glance
| What | Detail |
|---|---|
| Campaign first spotted | 11 November 2026, about 17:47 UTC, by Huntress |
| Confirmed so far | 6 compromised MSPs; 286+ endpoints across 47 organisations (later 288 across 48) |
| Method | Abuse of ScreenConnect Run Command to install rogue clients; no ScreenConnect vulnerability blamed |
| Suspected way in | Third-party extensions (RMM+ family); initial access still under investigation |
| Extensions disabled | Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link — about 400 partner environments |
| Toolkit found | SCKit, with RelayTrap targeting technicians; blocked by the CVE-2026-84869 fix in client 26.6.5 |
| Rogue client IDs | 2588ef5c15954b10 and ed630cc2c873b091 |
What to check now — for MSPs and their customers
✅ If you are an MSP or run your own ScreenConnect: confirm the five named extensions are disabled and do not re-enable them until ConnectWise gives the all-clear (on-premises customers must disable them manually). Review Run Command history, Toolbox records, authentication logs and extension installation records — Huntress advises checking Run Command history even without alerts. Revoke active sessions, reset credentials from a clean device, confirm MFA on every technician and admin account, update Host and Guest clients to 26.6.5.9742 or later, and hunt for RelayTrap artefacts (a TrapWatch scheduled task, a C:\ProgramData\RelayTrap folder, a RelayTrapLiteAlert Run key) before opening an interactive session to any suspect machine.
⏳ If your business uses an outside IT provider: ask them in writing whether they use ScreenConnect, whether they were told about this campaign, and whether any of your machines were touched. Check installed programs on each computer for a remote-access tool you did not approve — each ScreenConnect client registers a service named like "ScreenConnect Client (16-character ID)", and any ID that is not your provider's is suspect. And do not let a technician investigate a suspect machine through the same remote tool; use separate security software instead.
FAQs
Is ScreenConnect hacked?
Not exactly. Attackers compromised the ScreenConnect accounts of several MSPs, not ScreenConnect itself. ConnectWise says it has found no evidence of a compromise of its own infrastructure or that initial access involved a ScreenConnect vulnerability. The danger is that a hijacked MSP panel can reach every computer that MSP manages.
How do I know if a rogue ScreenConnect client is on my computer?
Look in installed programs for a second ScreenConnect entry, and check the service names for IDs that are not your provider's. The two rogue client IDs published by Huntress are 2588ef5c15954b10 and ed630cc2c873b091. Your provider can also check its Run Command history for commands it did not issue.
Does changing the password remove the rogue client?
No. The rogue client reports to infrastructure the attackers control, so it keeps working even after the MSP resets its passwords and cleans up its own account. The client itself has to be found and removed, and the machine investigated, before the access is gone.
What is SCKit and RelayTrap?
SCKit is a custom toolkit researchers found the rogue clients delivering. Its RelayTrap component waits on an infected customer machine and tries to compromise the technician who connects to it, including by stealing the technician's session cookie. ConnectWise says the technique is blocked by the fix for CVE-2026-84869 in ScreenConnect client version 26.6.5.
Takeaway: The week's lesson for anyone who outsources IT is that your provider's tools are part of your security. A hijacked remote-access console reaches every machine it manages, so the check that matters today is a plain question to your provider — followed by a look at what is actually installed on your computers.
If your business uses an outside IT provider, ask them today whether they use ScreenConnect and whether any of your machines were touched, and check the ConnectWise Trust Center advisory for the latest guidance.
Sources
- ConnectWise Trust Center — ScreenConnect security advisory: precautionary extension disabling and partner guidance (primary source; last updated 12 November 2026, 18:45 UTC)
- BleepingComputer — Active ScreenConnect attacks breach MSPs, impact dozens of organizations (11 November 2026)
- The Hacker News — ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
- SC Media — ConnectWise investigating reports of unauthorized access to third-party extensions (12 November 2026)
- Duggan — SCKit Waits on the Customer's Machine for Your Technician to Connect (Blackpoint Cyber SCKit/RelayTrap analysis, 12 November 2026)
Comments
Post a Comment