Summary
- Huntress observed 288 affected hosts across 48 organisations in its telemetry.
- ConnectWise disabled third-party extensions across approximately 400 partner environments as a precaution.
- Researchers identified malware designed to spread through technician sessions, but have not confirmed successful propagation through that mechanism.
Attackers deployed unauthorised ScreenConnect clients and malicious software to at least 288 endpoints across 48 organisations monitored by Huntress.
Security company Huntress identified activity affecting at least 288 hosts across 48 organisations in its monitored customer population on 11 November. The observed deployments occurred over approximately 90 minutes and involved attackers using remote management functionality to execute commands against groups of managed endpoints.
ConnectWise is investigating how the attackers gained access. Its initial assessment points towards possible abuse of independently developed third-party extensions installed in certain partner environments, rather than an established compromise of ConnectWise’s own infrastructure.
The company identified approximately 400 partner environments containing extensions from the RMM+ family and disabled the identified extensions wherever it could act directly. Their presence does not establish that an environment was compromised.
Remote management access creates downstream exposure
ScreenConnect provides remote support and management capabilities used by technology providers to administer customer devices. Such platforms are particularly sensitive because a single technician account or management console can provide authorised access to numerous systems across several organisations.
Once attackers gain equivalent privileges, legitimate remote management functionality can become an efficient mechanism for distributing malicious software. The resulting activity may appear within tools that customers already trust and permit for routine support operations.
Huntress reported that the attackers used ScreenConnect functionality to install rogue clients alongside a toolkit known as SCKit. The malware package contains scripts and supporting components designed to extend access beyond the systems initially reached.
Researchers found that SCKit includes functionality intended to spread from an infected endpoint to a technician workstation during a remote session, potentially creating further opportunities to access other devices managed by that technician.
That propagation capability must be distinguished from observed outcomes. Huntress says it has not seen the mechanism succeed in the incidents analysed, and recovered logs showed failed attempts to take over technician consoles. Confirmed malicious client deployments should not therefore be described as evidence that the toolkit successfully spread through every available management relationship.
Extension controls and client patching
ConnectWise identified five extensions for precautionary disabling: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. They provide additional functionality, including an API for executing remote commands, and are not part of the core product itself.
Huntress identified an authentication weakness in RMM+ versions 1.0.31 and 1.0.32. Where administrators had not configured the extension’s access key, the software could accept an empty value, potentially enabling remote commands without passing through ScreenConnect’s ordinary user authentication controls. Researchers associated the observed malicious commands with RMM+ activity, although the complete initial access sequence remains under investigation.
Separately, CVE-2026-84869 concerns unauthorised file transfer and execution during active remote sessions. ConnectWise says the correction delivered in technician client version 26.6.5 blocks the endpoint-to-technician propagation technique identified in SCKit. It does not prevent every form of malicious deployment through an already compromised management environment.
This distinction creates two separate remediation requirements: reducing the ability of attackers to exploit vulnerable extension or client behaviour, and investigating whether unauthorised activity has already occurred within partner and customer environments.
ConnectWise says it cannot independently determine everything that happened inside partner networks after unauthorised access was obtained. Relevant evidence may therefore reside across identity providers, management console records, endpoint telemetry and customer systems rather than within the vendor’s central infrastructure.
The investigation remains active, with ConnectWise reporting no evidence that its own infrastructure was compromised. The incident demonstrates how delegated access, extension governance and technician endpoint integrity can combine into a significant third-party risk when remote management platforms are abused.
