What happened

Confirmed Sophos X-Ops is investigating unauthorised ScreenConnect client deployments. It saw three compromised ScreenConnect instances used to run commands and two malicious instances receiving the new clients, and notes that ConnectWise has confirmed the incident and advised disabling the extensions under investigation. Sophos

Reported Huntress first saw the activity at about 17:47 UTC on 11 November. Attackers used Run Command on cloud-hosted ScreenConnect panels to install rogue clients on at least 288 endpoints in 48 organisations, all within about 90 minutes and roughly a third in the first ten. Huntress’s first count on Reddit was six MSPs. The rogue clients deliver SCKit, a 16-file toolkit. The Hacker News The Register ConnectWise disabled five extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) where it could, and found about 400 partner environments with at least one installed; that is not a count of victims. BleepingComputer

Reported Likely way in. Huntress traced the activity to a possible authentication weakness in RMM+, an extension that lets other tools send commands through ScreenConnect without using the console. Versions 1.0.31 and 1.0.32 accept a blank access key when none has been set, and work outside ScreenConnect’s own logins and MFA. Its investigators saw commands arrive with no matching logins. Attacks hit ScreenConnect 26.6.6.9747 and 26.7.6.9783, so being on the latest release didn’t protect anyone. The Register ConnectWise says it has found no evidence of a compromise of its own infrastructure or of a ScreenConnect vulnerability, and that initial access is still under investigation. No CVE is assigned. Its November advisory wasn’t on the public advisories index when MAG212 checked. The Hacker News ConnectWise

Who is affected and how it works

Reported MSPs whose ScreenConnect has one of the five extensions, especially RMM+, and every organisation they manage. ConnectWise says having an extension doesn’t mean a partner was compromised, that disabling it doesn’t remove access already gained, and that on-prem owners must disable the extensions themselves. BleepingComputer Confirmed In one case Sophos saw curl.exe download the client to C:\Windows\TEMP\sc.msi, msiexec.exe install it silently, then PowerShell with an execution-policy bypass fetch a second-stage script. Sophos Reported SCKit adds Defender exclusions, installs a second attacker-controlled client, creates a scheduled task named TrapWatch and replaces the genuine ScreenConnect install with an attacker copy. A component Huntress calls RelayTrap waits for a technician to connect, to steal session cookies and pivot to other panels; Huntress rebuilt that step from code and hasn’t seen it succeed. Some machines were reinfected within minutes of leaving isolation. The Hacker News The Register

What to look for

# ScreenConnect client services: the ID in brackets is the instance the client reports to
Get-CimInstance Win32_Service | Where-Object { $_.Name -like 'ScreenConnect Client (*' } |
  Select-Object Name, State, PathName
# Live connections to the published relay / secondary C2
Get-NetTCPConnection -RemoteAddress 185.99.255.28,155.94.150.39 -ErrorAction SilentlyContinue
# Recently resolved names that match the published domains
Get-DnsClientCache | Where-Object { $_.Entry -match 'gotdns\.org|homedns\.org|payproofkit|mo7sen|cdn007-digitaldownloads' }
# Published file names, and Defender exclusions added by the operator
Get-ChildItem C:\Users,C:\ProgramData,C:\Windows\Temp -Recurse -File -ErrorAction SilentlyContinue `
  -Include Panel-Lateral.ps1,runnew.cmd,ToolboxRelayUploader.exe,Run-Lateral-Full.bat,sckit-*,TrapWatch.ps1
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess
# SCKit persistence: TrapWatch task, RelayTrap folder, staged installer, Run key
Get-ScheduledTask -TaskName 'TrapWatch*' -ErrorAction SilentlyContinue
Test-Path 'C:\ProgramData\RelayTrap', 'C:\Windows\Temp\sc.msi'
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v RelayTrapLiteAlert 2>$null
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RelayTrapLiteAlert 2>$null

Investigate, contain and remediate (in order)

1. Don’t open interactive ScreenConnect sessions to any device that may be compromised. Investigate with separate security tools. (ConnectWise)
2. Keep the five extensions disabled, RMM+ above all; on-prem servers, disable them yourself. Keep their installation records and logs. Don’t re-enable until ConnectWise says so.
3. Review authentication logs, extension installation records, admin activity, Run Command history and Toolbox records, back to before 11 November.
4. Revoke active sessions, reset credentials from a trusted device, verify MFA on every ScreenConnect account. BleepingComputer
5. Isolate and clean infected hosts completely before reconnecting: rogue clients, the TrapWatch task, the RelayTrap folder, SCKit files and the RelayTrapLiteAlert Run key. Huntress saw reinfection within minutes of isolation ending. The Register IT Security Guru
6. MAG212 analysis Check that the genuine ScreenConnect client is still the one running; SCKit replaces it with an attacker copy. Reimage confirmed hits if in doubt, and check technician workstations too.
7. MAG212 analysis Customers: ask your MSP today whether it uses ScreenConnect, whether any of the five extensions were enabled, and what it has checked on your machines.

Verify recovery: every endpoint shows only approved ScreenConnect client IDs; no traffic to the indicators for 72 hours; Run Command history reviewed and signed off; all operator sessions re-established after the credential reset. Prevention MAG212 analysis: treat RMM extensions like code you deploy to every customer. An extension with its own API key can sidestep your MFA: keep an approved list, set strong keys on every integration API, restrict operator logins by IP, and alert on Run Command used outside change windows.

What happened

Confirmed CISA added all four to the Known Exploited Vulnerabilities catalog on 9 November with a 12 November due date. Ransomware use is “Unknown” for each. Federal agencies must fix them today; for everyone else, a three-day clock means CISA sees real risk. CISA KEV

Who is affected and how each works

Reported SSHole was attacked fast: Previdian saw a first attempt under nine hours after disclosure and confirmed root on an Alpine honeypot. A self-hosting blog argues the root cause lies in musl rather than OpenSSH; for defenders the fix is the same. Help Net Security botmonster Unknown Who exploited GPUStack, FreeSWITCH and Faspex; no IOCs have been published for any of the four.

# OpenSSH: version, libc and the two settings that decide exposure
ssh -V
ldd "$(command -v sshd)" 2>/dev/null | grep -i musl
sshd -T 2>/dev/null | grep -Ei '^(passwordauthentication|usepam) '
# Recent password logins (Alpine logs to /var/log/messages by default)
grep -h 'Accepted password' /var/log/messages /var/log/auth.log 2>/dev/null | tail -n 50
# FreeSWITCH: version
fs_cli -x 'version'

Contain and remediate (in order)

1. Inventory musl-based hosts and images running sshd, GPUStack servers, FreeSWITCH boxes and Faspex instances; take any internet-facing ones off the internet if you can’t patch today.
2. Patch to the fixed versions above, or apply the workarounds as a stop-gap.
3. MAG212 analysis Triage anything exposed since disclosure: new SSH keys, cron jobs, miners, GPUStack API keys you didn’t create, unexpected FreeSWITCH dialplan or Lua changes, Faspex admin accounts.
4. MAG212 analysis GPUStack exposes cloud-provider and worker secrets: rotate them on any instance that was reachable.

Verify recovery: fixed versions confirmed on every instance; PasswordAuthentication no where password login isn’t needed; no unexplained accounts or keys. Prevention MAG212 analysis: AI and GPU management servers are now on attackers’ lists; put them behind the same access controls as any admin console.

What happened

Confirmed Zoom’s bulletin ZSB-26023 rates CVE-2026-108186 Critical (CVSS 9.6, vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): improper input validation in Zoom Workplace for Windows that “may allow an unauthenticated user to conduct an escalation of privilege via network access”. It affects 7.1.0 up to, but not including, 7.1.8, and was found by Zoom Offensive Security. ZSB-26024 covers CVE-2026-108187 (8.1, origin validation error) in versions before 7.1.5, reported by “shmoul”. Both were published on 10 November. Zoom ZSB-26023 ZSB-26024

Who is affected and how it works

Confirmed Windows installs of Zoom Workplace in those ranges. Reported Neither Zoom nor the press reports exploitation, and 7.1.8 fixes both. The Hacker News SecurityWeek Unknown The exact attack scenario. Both vectors need a user action, such as joining a meeting or clicking a link; we won’t guess which. Whether macOS, Linux, VDI or Rooms builds share either flaw isn’t stated in what we read.

What to look for, then fix

1. Find the version across the fleet with your software inventory or MDM; anything from 7.1.0 to 7.1.7 has the 9.6 flaw, and anything before 7.1.5 has both.
2. Push 7.1.8 or later and turn on Zoom’s auto-update where users install it themselves.
3. MAG212 analysis No indicators exist. Until patched, watch for Zoom processes spawning shells or writing to system folders.

Verify recovery: the inventory shows no Windows build below 7.1.8. Prevention MAG212 analysis: user-installed per-user Zoom copies often escape central patching; block them or bring them under management.

What happened

Reported Cynet’s CyOps and research teams found Qlik Sense servers at several EU-based customers trying to launch PowerShell reverse shells to 45.115.26[.]23 in October, all within a window of just over three minutes. The initial command was Nishang’s one-line reverse shell, run under Qlik’s scheduler.exe; Cynet blocked the spawn attempts. An open directory on the same IP held a Go backdoor, SSH persistence scripts, an Apache ActiveMQ CVE-2023-46604 exploit and a modified Veeam CVE-2024-40711 toolchain. The Hacker News Mallory Cynet has published its research; MAG212 found it but couldn’t open it, so the details come through the press. Cynet

Who is affected and how it works

Reported Internet-facing Qlik Sense Enterprise for Windows servers. Which Qlik flaw was used isn’t known. The likely candidates are the 2023 trio: CVE-2023-41265 (HTTP tunnelling), CVE-2023-41266 (path traversal) and CVE-2023-48365 “DoubleQlik”, an incomplete fix for the first. The persistence script installs a legitimate OpenSSH package, sets sshd to start automatically, opens inbound TCP 22, and runs C:\ProgramData\ssh\winc.ps1 from a task named WinUpdCheck every five minutes. On Linux the Go backdoor reads /etc/shadow and /etc/passwd and looks for running ActiveMQ. The Hacker News MAG212 analysis The scheduler.exe parent matches the 2023 CACTUS ransomware intrusions documented by Arctic Wolf, but nobody has attributed this activity. Arctic Wolf (2023)

# Persistence artefacts named in the report
Get-ScheduledTask -TaskName 'WinUpdCheck' -ErrorAction SilentlyContinue
Test-Path 'C:\ProgramData\ssh\winc.ps1'
Get-Service sshd -ErrorAction SilentlyContinue
# Connections to the reported C2
Get-NetTCPConnection -RemoteAddress 45.115.26.23 -ErrorAction SilentlyContinue
# Process-creation events with Qlik's scheduler as parent (needs 4688 auditing)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 20000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Scheduler\.exe' -and $_.Message -match 'powershell|cmd\.exe' } |
  Select-Object TimeCreated, Message

Contain and remediate (in order)

1. Take Qlik Sense off the internet or put it behind VPN or SSO; block 45.115.26[.]23.
2. Patch Qlik Sense to a release that fixes all three 2023 CVEs (see Qlik’s support articles). Qlik
3. Run the host check; on a hit, remove the task, script, sshd service and TCP 22 rule, rotate the Qlik service account and rebuild.
4. MAG212 analysis Check the next targets: ActiveMQ patched for CVE-2023-46604, Veeam Backup & Replication for CVE-2024-40711. Neither should be reachable from the Qlik server.

Verify recovery: Qlik build confirmed; no scheduler.exe-spawned shells for 7 days; ActiveMQ and Veeam versions checked. Prevention MAG212 analysis: three-year-old Qlik bugs are still paying off for attackers. Analytics servers are often forgotten in patch cycles, so add them to yours.

What happened

Confirmed Arctic Wolf says it is tracking attackers running self-hosted agentic pentesting frameworks, including AntiFox, from public cloud. In several recent intrusions, Alibaba Cloud systems hosting AntiFox interfaces were tied to confirmed malicious actions against internet-facing web services and the AWS environments behind them, chaining web exploitation, web shells, config discovery, credential checks, cloud enumeration, secret access and storage operations. Arctic Wolf Reported The attackers used valid IAM users and, in some cases, an assumed EC2 role. In one intrusion they cycled through several identities and made hundreds of API calls in about 30 minutes. AntiFox began as a fork of ARTEX 0.1.1, the framework Datadog reported in AWS attacks in October. BleepingComputer GBHackers Datadog MAG212 analysis “Linked to” means the tool was used; no threat actor is named and the maintainers aren’t accused. Public-cloud addresses can be reassigned, as Arctic Wolf warns.

Who is affected and how it works

Reported Web: on a compromised IIS application (entry flaw unknown), w3wp.exe wrote an ASPX web shell and ran commands through it, hunted for web.config files and backups, read connection strings and logs, tried an internal production database, and copied files into a web-accessible upload folder. AWS: starting from a valid credential (origin not stated), the actor enumerated IAM, S3, Secrets Manager, KMS, RDS, Lambda and Bedrock. Most calls returned AccessDenied, but some succeeded, including at least one GetSecretValue on a production secret. The Hacker News Confirmed Arctic Wolf’s alert lists file patterns in the web-accessible upload folder: *.aspx, pwn*.aspx, cfg*.txt, wc*.txt, el*.txt, and the AntiFox console title “AntiFox — 自主渗透测试控制台”. Arctic Wolf

# Who read secrets since 1 Oct (management events, per region, last 90 days)
aws cloudtrail lookup-events --region us-east-1 \
  --lookup-attributes AttributeKey=EventName,AttributeValue=GetSecretValue \
  --start-time 2026-10-01T00:00:00Z \
  --query 'Events[].[EventTime,Username,CloudTrailEvent]' --output text | head -n 200
# PowerShell on the IIS server: .aspx files written in the last 30 days
Get-ChildItem C:\inetpub -Recurse -Include *.aspx,*.ashx,cfg*.txt,wc*.txt,el*.txt -File -ErrorAction SilentlyContinue |
  Where-Object LastWriteTime -gt (Get-Date).AddDays(-30) | Select-Object FullName, LastWriteTime

Contain and remediate (in order)

1. MAG212 analysis Alert on w3wp.exe creating .aspx files or spawning cmd/PowerShell, and on one identity making a burst of List/Describe calls across many services with a high AccessDenied rate.
2. Revoke affected sessions and access keys, and rotate any secret read by an unexpected principal and every credential in a harvested web.config; this is Arctic Wolf’s advice. In CloudTrail, look for the few successful calls inside bursts of denials. GBHackers BleepingComputer
3. Remove long-lived access keys and cut IAM permissions to what each workload uses; restrict secretsmanager:GetSecretValue by resource.

Verify recovery: rotated secrets in use and old values revoked; no unknown principals in CloudTrail for 7 days; web roots match deployed builds. Prevention MAG212 analysis: AI agents make noisy, broad enumeration cheap. That noise is your detection opportunity, if CloudTrail goes somewhere someone watches.

What happened

Confirmed Apache rates CVE-2026-119618 Critical: improper synchronisation of a shared resource in mod_http2’s assign_headers() can cause heap corruption and remote code execution. It affects httpd 2.4.55 to 2.4.70 and the standalone mod_h2 2.0.8 to 2.0.42, and is fixed in 2.4.71, released 11 November. Anthropic’s OSS Scanner reported it on 26 October and Google Cloud Vulnerability Research (Anthony Weems, Simon Scannell) on 3 November. The same release fixes CVE-2026-106023 (Important: mod_md NULL dereference crashes a child process, 2.4.30–2.4.70) and CVE-2026-109163 (Low: mod_vhost_alias one-byte stack overwrite). Apache

Reported Red Hat scores it 9.8 but rates it “Important” on RHEL 9 and 10 because of per-stream memory allocators. Unknown Whether it is exploited: Red Hat says public research has shown a reliable exploit, without citing it; Wiz says no exploit is available and none has been seen in the wild. The Hacker News

Who is affected

Reported Only servers in the version range with HTTP/2 enabled through the Protocols directive. MAG212 analysis That still covers many school, SMB and hosting servers, and appliances that bundle httpd, whose vendor patches will lag upstream.

# Version (apache2ctl on Debian/Ubuntu, apachectl on RHEL)
apachectl -v 2>/dev/null || apache2ctl -v
# Is mod_http2 loaded?
(apachectl -M 2>/dev/null || apache2ctl -M) | grep -i http2
# Where is HTTP/2 switched on?
grep -RniE '^\s*Protocols\s' /etc/apache2 /etc/httpd 2>/dev/null

Remediate

1. Update to 2.4.71 or your distribution’s fixed package.
2. Until then, remove h2 and h2c from Protocols and reload; clients fall back to HTTP/1.1. There is no official workaround; this is Wiz’s suggestion. The Hacker News
3. Ask appliance vendors whether their bundled httpd is affected.

Verify recovery: apachectl -v shows the fixed build, or an HTTP/2 test (for example curl -sI --http2 https://your.site) shows HTTP/1.1. Prevention MAG212 analysis: keep a list of every server that bundles a web server, including appliances, so the next httpd bug takes minutes to scope.

What happened, who is affected and how it works

Reported Ivanti fixed an Endpoint Manager SQL injection that can lead to unauthenticated remote code execution (CVE-2026-121653, 9.8; EPM 2024 SU8) and a Cloud Services Application missing-authentication flaw that lets an attacker add or delete trusted EPM Core certificate entries (CVE-2026-121683, 9.4; CSA 5.0.8.1). CSA with a dual-NIC setup isn’t externally exploitable. A high-severity Sentry RCE (CVE-2026-105425) is also fixed. Confirmed Ivanti’s own update post says it has no evidence of these flaws being exploited and names four Sentry CVEs (CVE-2026-105425, -105669, -123179, -123181), a User Workspace Manager flaw (CVE-2026-105813) and CVE-2026-121683 for CSA, plus EPM and EPMM advisories. Ivanti Reported Citrix’s XenServer update fixes CVE-2026-102705, which could let an attacker infer the pool secret and compromise the host, plus five privilege-escalation and task-termination issues and mitigations for AMD guest-to-host flaws; Citrix doesn’t state exploitation. SecurityWeek MAG212 opened Ivanti’s summary post but not the per-product advisories or Citrix’s bulletin, so the EPM score and fixed builds come from SecurityWeek. Citrix

What to look for, then fix (in order)

1. EPM core servers first: upgrade to 2024 SU8. MAG212 analysis Ivanti flaws have a history of fast weaponisation once patches are diffed; don’t wait for a KEV entry.
2. CSA: 5.0.8.1; check whether yours runs single-NIC.
3. MAG212 analysis After patching, review EPM’s trusted certificate list for entries you didn’t add.
4. XenServer: apply CTX697316; keep the management network isolated (the same lesson as this week’s Xen Orchestra attacks).

Verify recovery: versions confirmed; EPM certificate list reviewed. Prevention MAG212 analysis: endpoint-management servers can push code to every machine, like the ScreenConnect consoles in story 1. Give them the same isolation as a domain controller.

Barracuda: one day left

Confirmed CVE-2026-116606 and CVE-2026-111560 are due 13 November, with forensic triage flagged. Barracuda’s workaround is to restrict the admin UI to trusted networks; patch IDs are on the advisory. No IOCs have been published. CISA KEV Barracuda To do: confirm patch IDs on every ESG, ADC, BMA, WCC, WAF and WSG; review config-import and restore history on any box whose admin UI was reachable.

Xen Orchestra: exploited, still no CVE

Confirmed Vates’ VSA-2026-062 (exploited “empty-object” token bypass, root on XCP-ng hosts) still lists no CVE; fixed in XO 6.9.2 and 6.10.1. VSA-2026-063 (Important) was published the same day. Exploitation leaves no log entries, so run the vendor’s host checks and block its published IPs and onion C2. Vates Unknown MAG212 couldn’t locate SecurityWeek’s 11 November article on these flaws, so we can’t say whether it reports VSA-2026-063 as exploited.

eMudhra: certificates stop being trusted

Reported After a key-transfer script truncated private keys at an April 2025 key ceremony, eMudhra revoked eight more intermediates (six TLS, two code-signing), using a revocation reason Mozilla participants have questioned. From 16 November G1 issuance stops, Microsoft starts removing ten eMudhra roots, and Chrome and Firefox distrust G1 certificates issued after that date. Apple ends trust in all G1 certificates on 30 November. eMudhra reports no known misuse and is leaving public TLS. The main remaining G1 user is “a North American university federation”. The Hacker News Microsoft MAG212 analysis To do: search your certificate inventory and code-signing chains for emSign/eMudhra issuers and replace them before 16 November. Universities in federated identity schemes should ask their federation today.

Asus routers: four CVEs, none known exploited

Reported SecurityWeek says Asus disclosed four high- and medium-severity router firmware flaws that could allow root command execution or memory overwrite. SecurityWeek CVE records published on 10 November match that count, all for firmware series 3.0.0.4.386, 3.0.0.4.388 and 3.0.0.6.102:

To do: update router firmware from Asus’s advisory page; until then, keep untrusted devices off the router’s local network and disable unused USB and remote-admin features. MAG212 analysis Small offices and home workers are the exposure here.

Defender’s Action Desk

Prioritised from today’s stories. MAG212 analysis for the ordering; sources are in each article.

• NowScreenConnect (MSPs): no sessions to suspect devices; keep the 5 extensions off (RMM+ first); review Run Command/Toolbox; revoke sessions, reset creds from a clean device, verify MFA. → 01
• NowScreenConnect (customers): run the endpoint sweep (rogue IDs, TrapWatch, RelayTrap); clean fully before un-isolating; ask your MSP the three questions. → 01
• NowKEV due today: OpenSSH 10.6p2 on musl, GPUStack 2.2.2, FreeSWITCH 1.11.3, Faspex 5.0.19 PL1; triage anything exposed. → 02
• TodayBarracuda (due 13 Nov): patch IDs and config-history review. → 08
• TodayQlik Sense: off the internet; host check; ActiveMQ and Veeam versions. → 04
• TodayAWS: review GetSecretValue callers since 1 Oct; alert on w3wp.exe writing .aspx. → 05
• This weekPatches: Zoom 7.1.8; httpd 2.4.71 or drop h2/h2c; Ivanti EPM SU8 and CSA 5.0.8.1; XenServer CTX697316. → 03 → 06 → 07
• By 16 NoveMudhra: replace emSign/eMudhra certificates and code-signing chains. → 08

KEV deadlines (federal due dates; a priority signal for everyone)