Overview
- Huntress detected the campaign on Wednesday and reported that attackers used cloud‑hosted ScreenConnect panels' Run Command to install rogue ScreenConnect clients on at least 288 endpoints across 48 organizations.
- The delivered toolkit, called SCKit, installs persistent backdoors, adds Defender exclusions, compiles a host‑specific RelayTrap binary to intercept session cookies, and is designed to push itself to technician workstations and other managed endpoints.
- Huntress's telemetry points to abuse of an RMM+ family extension that in versions 1.0.31 and 1.0.32 accepted a blank access key by default, allowing API calls to execute Run Command without normal ScreenConnect account or MFA checks.
- ConnectWise disabled five third‑party extensions across roughly 400 partner environments and published containment guidance while Huntress, Blackpoint and others released indicators of compromise and cleanup steps.
- Responders warn technicians not to use ScreenConnect to triage suspected hosts, to audit Run Command and Toolbox histories, rotate exposed credentials from a clean device, and expect further scope updates as the investigation and remediation continue.