Hackers Deploy Malware in Fresh ScreenConnect Campaign
Hackers exploit RMM+ extension vulnerability to deploy SCKit malware via ScreenConnect.
A threat actor has compromised hundreds of endpoints in a fresh campaign by exploiting a vulnerability in the RMM+ ScreenConnect extension. The attackers used the flaw to bypass authentication and deploy a malware toolkit called SCKit, which provides backdoor access and can self-replicate. ConnectWise has disabled several RMM+ family extensions to mitigate the threat.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ConnectWise?
Get an email when a new story names ConnectWise, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited an unpatched authentication bypass vulnerability in the ScreenConnect RMM+ extension to compromise hundreds of endpoints, deploying a self-replicating backdoor toolkit called SCKit. Remote Monitoring and Management (RMM) tools are high-value targets because they already have privileged, broad access across managed endpoints — a single flaw can cascade into enterprise-wide compromise. The delay between vulnerability disclosure and patching (or disabling) the affected extension gave attackers a critical window to operate. ConnectWise's decision to disable the RMM+ extensions entirely illustrates how dangerous unmitigated vulnerabilities in privileged remote-access tools can be. Organizations relying on third-party RMM solutions must treat them as critical attack surface requiring continuous vulnerability tracking.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SCKit