Minacce · 7 ore fa
Huntress ha contato 288 endpoint compromessi in 48 organizzazioni nella campagna contro ConnectWise ScreenConnect; Blackpoint ha poi trovato in SCKit un exploit per una falla del client già corretta.
La patch blocca quell’exploit, ma SCKit può anche dirottare sessioni autenticate e usare le normali funzioni di gestione di ScreenConnect per diffondersi. Quando un tecnico si collega a un endpoint infetto, la sessione di assistenza può diventare un ponte verso la sua workstation e altri ambienti clienti accessibili.
ConnectWise ha disabilitato cinque estensioni della famiglia RMM+ in circa 400 ambienti, ma il loro ruolo nell’accesso iniziale è ancora sotto indagine. Correggere il client non elimina gli accessi o la persistenza già stabiliti: l’incidente può estendersi ai sistemi dei tecnici e agli altri clienti raggiungibili dalle loro sessioni.
7 fonti che coprono questa storia
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.
Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
ConnectWise disabled five third-party extensions across 400 partner environments after attackers abused RMM+ to deploy SCKit malware on 288 computers.
The Record from Recorded Future
Abuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise.
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
SCKit exploits patched ScreenConnect flaw CVE-2026-84869 and attempts to hijack technician sessions to spread across managed endpoints.
Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA
Hackers Deploy Malware in Fresh ScreenConnect Campaign
The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication.
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
Attackers abuse ScreenConnect access to deploy SCKit malware, targeting at least 288 endpoints across 48 organizations.
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
Part of the PlainSec briefing for 2026-11-13