ScreenConnect RMM+ extension: blank access key exploited

Call: Patch now, which here means disable the extensions. Attackers are pushing commands through ScreenConnect panels to managed endpoints. Huntress counts at least 288 machines across 48 organizations and six compromised MSPs, all hit on Nov 11. Huntress now ties it to RMM+, a third-party ScreenConnect extension. In versions 1.0.31 and 1.0.32, if nobody ever set the extension’s access key, it “would accept a blank one.” ConnectWise has disabled five extensions in about 400 partner environments where it could. On-premises partners have to do it themselves. There’s no ScreenConnect patch, because the hole is in the extension, not ScreenConnect itself.

What happened: Starting at about 17:47 UTC on Nov 11 (10:47 AM Mountain), Huntress saw an operator use ScreenConnect’s Run Command to install attacker-controlled ScreenConnect clients and a toolkit Huntress calls SCKit. All 288 hosts were hit within 90 minutes. RMM+ lets another tool drive ScreenConnect sessions with a shared access key and bypasses ScreenConnect’s own accounts, roles and MFA. Huntress says the malicious commands showed up in logs linked to RMM+ with “no corresponding login activity.” SCKit keeps its own remote access. It also waits for a technician to connect to an infected endpoint, infects the technician’s workstation, and spreads from there to every endpoint that technician’s panel can reach. Huntress says the attackers numbered their victims in order, which suggests MSPs it hasn’t seen were hit earlier.

Who’s hit: ScreenConnect partners, cloud or on-prem, with any of these installed: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link. ConnectWise says having one installed “does not establish compromise.” Huntress says panels on current ScreenConnect releases (26.6.6.9747 and 26.7.6.9783) were affected, so being up to date on ScreenConnect doesn’t protect you if the extension is there.

What to do:

On on-prem servers, disable all five extensions now. Check that they’re disabled on cloud instances too. Don’t reinstall them until ConnectWise says it’s safe.
Go through Run Command history even if no alerts fired. Huntress specifically recommends this because of the sequential numbering.
Look for ScreenConnect clients you didn’t deploy, on customer endpoints and on technician workstations.
Don’t open interactive ScreenConnect sessions to suspect machines. That’s exactly how SCKit spreads to technicians. Investigate with your EDR or other tools instead.
From a clean device, revoke active ScreenConnect and identity-provider sessions, reset credentials, and check MFA. ConnectWise notes that disabling the extensions doesn’t remove access the attackers already set up.
Huntress’s post has IOCs and file hashes.

Last night we were treating this as a stolen-credentials campaign. The RMM+ finding changes that. It’s an exploited flaw in a component you can turn off.

Sources: ConnectWise guidance (opens in a new tab), Huntress (opens in a new tab), BleepingComputer (opens in a new tab), SecurityWeek (opens in a new tab), The Register (opens in a new tab).

ScreenConnect RMM+ extension: blank access key exploited

Sources

More from November 2026 patch cycle