SecurityEndpoints & devicesNote
ScreenConnect attack hit 288 computers at 48 organisations through an add-on
ConnectWise’s advisory and Huntress’s write-up of 11 and 12 November: how a blank key on a third-party extension reached MSP customers, and what to check now.
An attacker used managed service providers’ ScreenConnect remote-support servers to push commands to at least 288 computers at 48 organisations on 11 November, all within 90 minutes of the first at about 17:47 UTC, Huntress says. A third were hit in the first ten minutes.2 Huntress ties the activity to RMM+, a third-party extension for ConnectWise’s ScreenConnect, whose versions 1.0.31 and 1.0.32 accepted a blank access key whenever an administrator had never set one.2 ConnectWise has switched off five such extensions in about 400 partner environments and says it has found no compromise of its own infrastructure and no vulnerability in ScreenConnect itself.1
288
computers reached, at organisations that use Huntress
Huntress
48
organisations affected
Huntress
90 min
from the first command to the last host seen
Huntress
~400
partner environments where ConnectWise disabled the extensions
ConnectWise
01A blank key on a remote-command add-on
RMM+ lets another management tool drive ScreenConnect sessions without a technician at the console. It bypasses ScreenConnect’s user accounts, roles and multi-factor sign-in and checks only a shared access key in its settings, which defaults to empty. Huntress saw commands reach endpoints across several ScreenConnect instances within minutes, with no matching login, and logged against RMM+.2 ConnectWise describes the five extensions it disabled (Labtech Plus, RMM Plus, RMM+, and two Password Link variants) as independently developed, offering “an API capable of executing remote commands” protected by a passphrase the partner sets.1 Neither company cites a CVE.
One unset key let the attacker run commands as SYSTEM on every endpoint a server managed
The attack path Huntress reconstructed from incidents and recovered scripts, 11 and 12 November 2026
- 01
An add-on with no key
RMM+ 1.0.31 or 1.0.32 on a cloud-hosted ScreenConnect server, its access key never set, accepts requests with a blank one.
- 02
Run Command, as SYSTEM
Commands go to groups of endpoints at once: install the attacker’s own ScreenConnect client, then a toolkit Huntress calls SCKit.
- 03
Take the client's place
A scheduled task, TrapWatch, runs every 10 seconds, stops the genuine client and puts the rogue one in its slot.
- 04
Wait for a technician
When a technician connects, a dropper is sent to their workstation to steal the session cookie and reach every other session they can open.
Source: Huntress, SCKit write-up and update of 11:34pm ET, 11 November 2026; ConnectWise advisory, 12 November 2026 · as of 12 November 2026 · Step 4 is designed into the kit; Huntress has not seen it succeed
Huntress’s first count, posted on Reddit and reported by BleepingComputer, was six compromised MSPs and more than 286 endpoints at 47 organisations, and still rising. Before the RMM+ finding, Huntress said its telemetry pointed to stolen credentials or hijacked operator sessions.3
02The second remote-management tool in a week
N-able took its hosted N-central service offline in three regions on 9 November after 33 exploits went public, and released a hotfix late on 10 November; we covered both in N-able takes N-central offline and its hotfix note. The two cases differ, a flaw in the vendor’s product there and an add-on here, but the reach is the same: one console that runs commands on every customer machine. ConnectWise was also restoring its Cloud Backup service, formerly SkyKick, after unauthorised access to its application credentials in October.1
03What an MSP's customer should check
Sources
- ConnectWise Trust Center: ScreenConnect security advisory, precautionary extension disabling and partner guidance (and Cloud Backup advisory) — 11 November 2026, updated 12 November 2026
- Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints — 11 November 2026, updated 12 November 2026
- BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations — 11 November 2026
Disclosure. TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
