Hackers used a ScreenConnect add-on to hit 288 PCs at 48 organizations in 90 minutes

Attackers broke into hundreds of computers managed with ConnectWise ScreenConnect, the remote-support tool widely used by IT departments and managed service providers (MSPs). Security firm Huntress says at least 288 endpoints at 48 organizations were compromised, and it has traced the way in to a third-party ScreenConnect extension called RMM+.

What happened

According to SecurityWeek, the attacks were observed on November 11 and touched at least six MSPs. Huntress found that all 288 machines were hit within 90 minutes, and The Register reports that about a third of them fell in the first ten minutes. Huntress suspects there are more victims than it has seen, because the attackers appeared to number their targets in sequence, which points to earlier attacks that went unnoticed, The Register says.

RMM+ lets outside management tools automate ScreenConnect sessions through an API protected by a shared access key. SecurityWeek and The Register report that versions 1.0.31 and 1.0.32 of the extension fell back to a blank key when one hadn't been configured, so an attacker could authenticate with an empty value. Huntress noticed commands reaching endpoints with no matching logins; the relevant logs pointed to RMM+ instead.

The Record adds a different angle. It reports that researchers at Blackpoint Cyber, who took apart the attackers' toolkit, found it exploits CVE-2026-84869, a ConnectWise vulnerability disclosed in September that CISA flagged as exploited that month, and that a fully patched client blocked the exploit. The Register, meanwhile, says affected ScreenConnect versions included recent 26.6 and 26.7 releases. The reports don't fully agree on how the patched and unpatched systems fit together, and ConnectWise has not confirmed how the attackers first got in.

A toolkit built to spread

The attackers installed rogue ScreenConnect clients so they could keep access even after the legitimate connection was cut, and deployed a 16-file toolkit Huntress calls SCKit. According to SecurityWeek, it waits for a technician to connect to an infected machine, then tries to infect the technician's own workstation and steal session cookies to reach other sessions and admin panels. The Register says Huntress has not yet seen that spreading step succeed, and that some machines were reinfected within minutes of being released from isolation because cleanup was incomplete. Huntress also suspects parts of the code were written with help from an AI model.

ConnectWise's response

ConnectWise says it found no evidence that its own infrastructure was breached or that ScreenConnect itself has a new vulnerability. It disabled five extensions in the RMM+ family — Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link — across about 400 cloud-hosted environments where at least one was installed, SecurityWeek reports. ConnectWise stressed that having one installed doesn't by itself mean a customer was compromised. Huntress and ConnectWise have published indicators of compromise.

What to do

If your organization or your IT provider uses ScreenConnect, the advice from ConnectWise and the researchers comes down to this:

• Self-hosted servers: disable every RMM+-family extension yourself; ConnectWise could only switch them off in its cloud.
• Patch: make sure ScreenConnect is current, including the fix for CVE-2026-84869.
• Don't investigate over ScreenConnect. Connecting to a suspect machine through the tool is exactly how SCKit tries to reach the technician's PC. Use other security tools to look for rogue ScreenConnect clients and review which commands were run.
• Resetting passwords isn't enough. ConnectWise warns it may not remove malware or backdoors already installed, so clean machines fully before putting them back on the network.
• Watch sign-ins for unusual logins and repeated failures.

Why it matters

Remote-management tools are a favorite target because one compromised console can reach every machine an MSP looks after. This campaign shows the risk can sit in an add-on rather than the main product: an extension installed for one project and then forgotten, which SecurityWeek says describes most of the RMM+ installs Huntress found. It's a good moment for any IT team to audit which plug-ins its remote-access tools are running and whether they still need them.