{"id":4202,"date":"2026-11-12T07:02:18","date_gmt":"2026-11-12T15:02:18","guid":{"rendered":"https:\/\/cyber.mag212.com\/screenconnect-sckit-msp-attack-rmm-plus-extension-rogue-clients-288-endpoints\/"},"modified":"2026-11-12T07:02:18","modified_gmt":"2026-11-12T15:02:18","slug":"screenconnect-sckit-msp-attack-rmm-plus-extension-rogue-clients-288-endpoints","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/screenconnect-sckit-msp-attack-rmm-plus-extension-rogue-clients-288-endpoints\/","title":{"rendered":"SCKit: Attackers Turn MSPs\u2019 ScreenConnect Consoles on Their Customers, Hitting 288 Endpoints in 90 Minutes"},"content":{"rendered":"\n

On the afternoon of 11 November, someone used the tools managed service providers rely on to look after their customers as a delivery system against those customers. Through cloud-hosted ConnectWise ScreenConnect panels, the attackers pushed rogue remote-access clients and a 16-file toolkit, SCKit, to at least 288 endpoints in 48 organisations in about 90 minutes. Sophos, Huntress and ConnectWise all confirm the activity. The likeliest way in is not a ScreenConnect bug at all but a third-party extension that, in some setups, accepts a blank key.<\/p>\n\n\n\n

Scale (Huntress)<\/strong><\/td>288+ endpoints \u00b7 48+ organisations \u00b7 in about 90 minutes<\/td><\/tr>
Suspected way in<\/strong><\/td>RMM+ extension 1.0.31\/1.0.32 accepts a blank key<\/td><\/tr>
Payload<\/strong><\/td>Rogue clients + SCKit (16 files, TrapWatch task)<\/td><\/tr>
Vendor action<\/strong><\/td>5 third-party extensions disabled; ~400 environments had one<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> Sophos X-Ops is investigating unauthorised ScreenConnect client deployments. It saw three compromised ScreenConnect instances<\/strong> used to run commands and two malicious instances<\/strong> receiving the new clients, and notes that ConnectWise has confirmed the incident and advised disabling the extensions under investigation. (Sophos<\/a>)<\/p>\n\n\n\n

[Reported]<\/strong> Huntress first saw the activity at about 17:47 UTC on 11 November<\/strong>. Attackers used Run Command<\/strong> on cloud-hosted ScreenConnect panels to install rogue clients on at least 288 endpoints in 48 organisations<\/strong>, all within about 90 minutes and roughly a third in the first ten. Huntress’s first count on Reddit was six MSPs. The rogue clients deliver SCKit<\/strong>, a 16-file toolkit. (The Hacker News<\/a>) (The Register<\/a>) ConnectWise disabled five extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link<\/strong>) where it could, and found about 400 partner environments with at least one installed; that is not a count of victims. (BleepingComputer<\/a>)<\/p>\n\n\n\n

[Reported]<\/strong> Likely way in.<\/strong> Huntress traced the activity to a possible authentication weakness in RMM+<\/strong>, an extension that lets other tools send commands through ScreenConnect without using the console. Versions 1.0.31 and 1.0.32 accept a blank access key when none has been set, and work outside ScreenConnect’s own logins and MFA. Its investigators saw commands arrive with no matching logins. Attacks hit ScreenConnect 26.6.6.9747 and 26.7.6.9783, so being on the latest release didn’t protect anyone. (The Register<\/a>) ConnectWise says it has found no evidence of a compromise of its own infrastructure or of a ScreenConnect vulnerability, and that initial access is still under investigation. No CVE is assigned.<\/strong> Its November advisory wasn’t on the public advisories index when MAG212 checked. (The Hacker News<\/a>) (ConnectWise<\/a>)<\/p>\n\n\n\n

\"Five-step
Figure 1 \u00b7 How the ScreenConnect campaign reached customers.<\/strong> From a suspected RMM+ weakness to persistent access, with Huntress’s counts. The way in is suspected, not confirmed, and there is no CVE. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected and how it works<\/h2>\n\n\n\n

[Reported]<\/strong> MSPs whose ScreenConnect has one of the five extensions, especially RMM+, and every organisation they manage. ConnectWise says having an extension doesn’t mean a partner was compromised, that disabling it doesn’t remove access already gained, and that on-prem owners must disable the extensions themselves. (BleepingComputer<\/a>) [Confirmed]<\/strong> In one case Sophos saw curl.exe<\/code> download the client to C:\\Windows\\TEMP\\sc.msi<\/code>, msiexec.exe<\/code> install it silently, then PowerShell with an execution-policy bypass fetch a second-stage script. (Sophos<\/a>) [Reported]<\/strong> SCKit adds Defender exclusions, installs a second attacker-controlled client, creates a scheduled task named TrapWatch<\/strong> and replaces the genuine ScreenConnect install with an attacker copy. A component Huntress calls RelayTrap waits for a technician to connect, to steal session cookies and pivot to other panels; Huntress rebuilt that step from code and hasn’t seen it succeed. Some machines were reinfected within minutes of leaving isolation<\/strong>. (The Hacker News<\/a>) (The Register<\/a>)<\/p>\n\n\n\n

What to look for<\/h2>\n\n\n\n
Type<\/th>Indicator (defanged)<\/th>Note<\/th><\/tr><\/thead>
Relay IP<\/td>185.99.255[.]28<\/code><\/td>Hostname “screen”; serves the MSI<\/td><\/tr>
C2<\/td>newnewnew.gotdns[.]org<\/code> \u00b7 soxnewwork.homedns[.]org<\/code><\/td>Possible: cdn007-digitaldownloads[.]com<\/code><\/td><\/tr>
Secondary C2<\/td>sc.payproofkit[.]com<\/code> (155.94.150[.]39<\/code>)<\/td>Hostname WIN-FB5CKHMU4E1<\/td><\/tr>
Stager<\/td>hxxps:\/\/ns.mo7sen[.]dev\/EadF.php?p=4<\/code><\/td>PowerShell second stage<\/td><\/tr>
Malicious instance IDs<\/td>2588ef5c15954b10<\/code> \u00b7 ed630cc2c873b091<\/code><\/td>Sophos; the second also appears in a July sample<\/td><\/tr>
Compromised instance IDs<\/td>d905b2b1b165d0a9<\/code> \u00b7 4b8f4089ddaac6a9<\/code> \u00b7 df1f7ef0cfacd0d8<\/code><\/td>Sophos: panels used to push the clients<\/td><\/tr>
SCKit artefacts<\/td>sckit-run.bat<\/code> \u00b7 sckit-decoder.ps1<\/code> \u00b7 TrapWatch.ps1<\/code> \u00b7 Sqlite3.exe<\/code> \u00b7 task TrapWatch<\/strong> \u00b7 C:\\ProgramData\\RelayTrap\\<\/code> \u00b7 Run key RelayTrapLiteAlert<\/code><\/td>Huntress via The Hacker News; folder and Run key per IT Security Guru<\/td><\/tr>
Installer<\/td>\/Bin\/ScreenConnect.ClientSetup.msi?\u2026&c=Exploited<N><\/code> \u00b7 C:\\Windows\\TEMP\\sc.msi<\/code><\/td>Sequential numbering<\/td><\/tr>
Account \/ files<\/td>Addmin<\/code> \u00b7 Panel-Lateral.ps1<\/code> \u00b7 runnew.cmd<\/code> \u00b7 ToolboxRelayUploader.exe<\/code> \u00b7 Run-Lateral-Full.bat<\/code><\/td>Purpose not described<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Sources: Sophos<\/a>; Huntress via BleepingComputer<\/a> and The Hacker News<\/a>; IT Security Guru<\/a>. Huntress’s own post was not opened by MAG212. [Reported]<\/strong> BleepingComputer also found a July 2026 sample, SSA-2026-STATEMENT-15518787.bat<\/code>, that references the second client ID; any link to this campaign is unclear.<\/em><\/p>\n\n\n\n

Endpoint sweep<\/h3>\n\n\n\n

OS: Windows 10\/11, Server 2016+ \u00b7 Shell: PowerShell 5.1 \u00b7 Privileges: local administrator \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

# ScreenConnect client services: the ID in brackets is the instance the client reports to\nGet-CimInstance Win32_Service | Where-Object { $_.Name -like 'ScreenConnect Client (*' } |\n  Select-Object Name, State, PathName\n# Live connections to the published relay \/ secondary C2\nGet-NetTCPConnection -RemoteAddress 185.99.255.28,155.94.150.39 -ErrorAction SilentlyContinue\n# Recently resolved names that match the published domains\nGet-DnsClientCache | Where-Object { $_.Entry -match 'gotdns\\.org|homedns\\.org|payproofkit|mo7sen|cdn007-digitaldownloads' }\n# Published file names, and Defender exclusions added by the operator\nGet-ChildItem C:\\Users,C:\\ProgramData,C:\\Windows\\Temp -Recurse -File -ErrorAction SilentlyContinue `\n  -Include Panel-Lateral.ps1,runnew.cmd,ToolboxRelayUploader.exe,Run-Lateral-Full.bat,sckit-*,TrapWatch.ps1\nGet-MpPreference | Select-Object ExclusionPath, ExclusionProcess\n# SCKit persistence: TrapWatch task, RelayTrap folder, staged installer, Run key\nGet-ScheduledTask -TaskName 'TrapWatch*' -ErrorAction SilentlyContinue\nTest-Path 'C:\\ProgramData\\RelayTrap', 'C:\\Windows\\Temp\\sc.msi'\nreg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \/v RelayTrapLiteAlert 2>$null\nreg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \/v RelayTrapLiteAlert 2>$null<\/code><\/pre>\n\n\n\n
Expected clean result: only your MSP’s own client ID in the service list, False False<\/code> from Test-Path, and no output from the other commands. Any service ID you don’t recognise, or either published ID, is a hit: isolate the device using your EDR, not ScreenConnect. Commands not tested by MAG212 CYBER.<\/strong> Indicators from Sophos<\/a> and Huntress via The Hacker News<\/a>.<\/p>\n\n\n\n
Investigate, contain and remediate (in order)<\/h2>\n\n\n\n
    \n
  1. Don’t open interactive ScreenConnect sessions<\/strong> to any device that may be compromised. Investigate with separate security tools. (ConnectWise)<\/li>\n\n\n
  2. Keep the five extensions disabled<\/strong>, RMM+ above all; on-prem servers, disable them yourself. Keep their installation records and logs. Don’t re-enable until ConnectWise says so.<\/li>\n\n\n
  3. Review<\/strong> authentication logs, extension installation records, admin activity, Run Command history and Toolbox records<\/strong>, back to before 11 November.<\/li>\n\n\n
  4. Revoke active sessions, reset credentials from a trusted device, verify MFA<\/strong> on every ScreenConnect account. (BleepingComputer<\/a>)<\/li>\n\n\n
  5. Isolate and clean infected hosts completely<\/strong> before reconnecting: rogue clients, the TrapWatch task, the RelayTrap folder, SCKit files and the RelayTrapLiteAlert Run key. Huntress saw reinfection within minutes of isolation ending. (The Register<\/a>) (IT Security Guru<\/a>)<\/li>\n\n\n
  6. [MAG212 analysis]<\/strong> Check that the genuine ScreenConnect client is still the one running; SCKit replaces it with an attacker copy. Reimage confirmed hits if in doubt, and check technician workstations too.<\/li>\n\n\n
  7. [MAG212 analysis]<\/strong> Customers: ask your MSP today whether it uses ScreenConnect, whether any of the five extensions were enabled, and what it has checked on your machines.<\/li>\n\n<\/ol>\n\n\n\n
    Verify recovery:<\/strong> every endpoint shows only approved ScreenConnect client IDs; no traffic to the indicators for 72 hours; Run Command history reviewed and signed off; all operator sessions re-established after the credential reset. Prevention<\/strong> [MAG212 analysis]<\/strong>: treat RMM extensions like code you deploy to every customer. An extension with its own API key can sidestep your MFA: keep an approved list, set strong keys on every integration API, restrict operator logins by IP, and alert on Run Command used outside change windows.<\/p>\n\n\n\n
    Why it matters<\/h2>\n\n\n\n
    An MSP\u2019s remote-management console is a master key to every client it serves, which makes it one of the most valuable targets in small-business and school IT. This campaign shows that an add-on with its own API can sidestep the console\u2019s logins and multi-factor authentication entirely, and that once rogue clients are in place, resetting passwords or disabling the extension does not remove them. The speed, a third of victims in ten minutes, leaves no time for manual response.<\/p>\n\n\n\n
    The bottom line<\/h2>\n\n\n\n
    MSPs should keep the five extensions disabled, review Run Command history now and investigate suspect machines only with separate tools. Every MSP customer should run the endpoint sweep, look for a TrapWatch task or unfamiliar ScreenConnect client IDs, and keep any infected machine isolated until it is fully cleaned.<\/p>\n\n\n\n
    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
    \n\n\n\n
    This story is part of MAG212 CYBER Daily, 12 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    Attackers used cloud-hosted ScreenConnect panels to push rogue clients and a toolkit called SCKit to at least 288 endpoints in 48 organisations. Huntress suspects a blank-key weakness in the RMM+ extension. There is no CVE, so patching won\u2019t fix it. Indicators, an endpoint sweep and the order of response.<\/p>","protected":false},"author":1,"featured_media":4185,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,15],"tags":[60,263,322,323,321,149],"class_list":["post-4202","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-incidents","category-threat-intelligence","tag-connectwise","tag-iocs","tag-msp-security","tag-remote-access","tag-screenconnect","tag-supply-chain"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4202"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4202\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4185"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}