Overview
- Security firm Huntress detected the campaign Wednesday after attackers used cloud‑hosted ScreenConnect panels to push Run commands that installed rogue ScreenConnect clients on at least 288 endpoints across 48 organizations.
- The attackers used ScreenConnect’s Run Command feature to download and silently install attacker‑controlled clients and a toolkit called SCKit that creates persistent backdoors and adds Defender exclusions.
- The malware was built to spread in two stages by stealing technician session cookies and replaying them to pivot to other panels, though defenders have not yet observed a confirmed full technician‑to‑panel propagation.
- ConnectWise is investigating, has disabled five third‑party ScreenConnect extensions across partner environments as a precaution, and has published IPs, domains and file artifacts to help partners hunt and contain activity.
- Analysts warn this incident highlights supply‑chain risk from MSP tools, notes a July 2026 batch script referencing a rogue client ID that suggests earlier related activity, and urges partners to revoke sessions, rotate credentials from clean devices, preserve logs, and apply published IoCs.