--- title: "ScreenConnect attack hit 288 computers at 48 organisations through an add-on" summary: "ConnectWise’s advisory and Huntress’s write-up of 11 and 12 November: how a blank key on a third-party extension reached MSP customers, and what to check now." url: https://www.thetechbag.com/blog/screenconnect-288-computers-48-organisations-add-on format: Note desk: "Security" area: "Endpoints & devices" region: Global published: 2026-11-12 facts_checked: 2026-11-12 author: TechBag (The TechBag Journal) tags: ["ScreenConnect attack","ConnectWise ScreenConnect","ScreenConnect breach","remote access software attack","ScreenConnect extension","RMM+ extension","ConnectWise","Huntress","managed service providers","MSP breach","RMM","remote access","rogue ScreenConnect client","SCKit","Run Command","session cookie theft","N-able","N-central","indicators of compromise"] cover: https://www.thetechbag.com/blog/covers/screenconnect-288-computers-48-organisations-add-on.png --- # ScreenConnect attack hit 288 computers at 48 organisations through an add-on *ConnectWise’s advisory and Huntress’s write-up of 11 and 12 November: how a blank key on a third-party extension reached MSP customers, and what to check now.* Note · Security · Endpoints & devices · By TechBag · Published 2026-11-12 · Facts checked 2026-11-12 · Canonical: https://www.thetechbag.com/blog/screenconnect-288-computers-48-organisations-add-on An attacker used managed service providers’ ScreenConnect remote-support servers to push commands to at least 288 computers at 48 organisations on 11 November, all within 90 minutes of the first at about 17:47 UTC, Huntress says. A third were hit in the first ten minutes.[2] Huntress ties the activity to RMM+, a third-party extension for ConnectWise’s ScreenConnect, whose versions 1.0.31 and 1.0.32 accepted a blank access key whenever an administrator had never set one.[2] ConnectWise has switched off five such extensions in about 400 partner environments and says it has found no compromise of its own infrastructure and no vulnerability in ScreenConnect itself.[1] 288 computers reached, at organisations that use Huntress Huntress 48 organisations affected Huntress 90 min from the first command to the last host seen Huntress ~400 partner environments where ConnectWise disabled the extensions ConnectWise ## A blank key on a remote-command add-on RMM+ lets another management tool drive ScreenConnect sessions without a technician at the console. It bypasses ScreenConnect’s user accounts, roles and multi-factor sign-in and checks only a shared access key in its settings, which defaults to empty. Huntress saw commands reach endpoints across several ScreenConnect instances within minutes, with no matching login, and logged against RMM+.[2] ConnectWise describes the five extensions it disabled (Labtech Plus, RMM Plus, RMM+, and two Password Link variants) as independently developed, offering “an API capable of executing remote commands” protected by a passphrase the partner sets.[1] Neither company cites a CVE. **Figure: One unset key let the attacker run commands as SYSTEM on every endpoint a server managed** *The attack path Huntress reconstructed from incidents and recovered scripts, 11 and 12 November 2026* 1. 01An add-on with no keyRMM+ 1.0.31 or 1.0.32 on a cloud-hosted ScreenConnect server, its access key never set, accepts requests with a blank one. 2. 02Run Command, as SYSTEMCommands go to groups of endpoints at once: install the attacker’s own ScreenConnect client, then a toolkit Huntress calls SCKit. 3. 03Take the client's placeA scheduled task, TrapWatch, runs every 10 seconds, stops the genuine client and puts the rogue one in its slot. 4. 04Wait for a technicianWhen a technician connects, a dropper is sent to their workstation to steal the session cookie and reach every other session they can open. Source: Huntress, SCKit write-up and update of 11:34pm ET, 11 November 2026; ConnectWise advisory, 12 November 2026 · as of 12 November 2026 · Step 4 is designed into the kit; Huntress has not seen it succeed Huntress’s first count, posted on Reddit and reported by BleepingComputer, was six compromised MSPs and more than 286 endpoints at 47 organisations, and still rising. Before the RMM+ finding, Huntress said its telemetry pointed to stolen credentials or hijacked operator sessions.[3] ## The second remote-management tool in a week N-able took its hosted N-central service offline in three regions on 9 November after 33 exploits went public, and released a hotfix late on 10 November; we covered both in [N-able takes N-central offline](https://www.thetechbag.com/blog/n-able-n-central-offline-33-exploits) and [its hotfix note](https://www.thetechbag.com/blog/n-able-hotfix-exposed-servers-1338-to-148). The two cases differ, a flaw in the vendor’s product there and an add-on here, but the reach is the same: one console that runs commands on every customer machine. ConnectWise was also restoring its Cloud Backup service, formerly SkyKick, after unauthorised access to its application credentials in October.[1] ## What an MSP's customer should check Our viewQuestions for your provider this week Does it run ScreenConnect with any of the five extensions, and when were they disabled? Has it searched Run Command and Toolbox history for commands nobody issued? Look on your own machines for a second ScreenConnect client service, a `TrapWatch` scheduled task and a `C:\ProgramData\RelayTrap` folder, all on ConnectWise’s indicator list. Both companies say not to open a ScreenConnect session to a suspect machine, but to investigate it with separate tools, revoke sessions and reset credentials from a clean device.[1][2] Disabling the extension does not remove what was already installed. How we did this Figures as of 12 November 2026, 8:30pm IST The 288 computers, 48 organisations, timings and the RMM+ finding are Huntress’s, from its post and its update of 11:34pm ET on 11 November; they cover organisations that use Huntress, so the full number may be higher. ConnectWise’s figures and guidance are from its advisory as last updated at 02:45 UTC on 12 November; it says the investigation continues. The six MSPs are Huntress’s early count via BleepingComputer. Neither company names an attacker, and nor do we. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [ConnectWise Trust Center: ScreenConnect security advisory, precautionary extension disabling and partner guidance (and Cloud Backup advisory)](https://www.connectwise.com/company/trust/advisories) — 11 November 2026, updated 12 November 2026 2. [Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints](https://www.huntress.com/blog/sckit-worm-rogue-screenconnect) — 11 November 2026, updated 12 November 2026 3. [BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/) — 11 November 2026 **Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [ScreenConnect intel page](https://www.thetechbag.com/connectwise/screenconnect) — what ScreenConnect is, cloud and on-premises, and its price - [N-able ships its N-central fix as exposed servers fall from 1,338 to about 148](https://www.thetechbag.com/blog/n-able-hotfix-exposed-servers-1338-to-148) — the other remote-management tool hit this week - [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the products that manage fleets from one console, compared