[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVpPfIazL99FV8G5TN-hIz1NoHVmhymd7fbn-882XyDw":3},{"article":4,"iocs":51,"watch_terms":55,"solutions":56,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"f1be62a7-c6a2-4a1d-bc0c-4cf78dddc8c6","Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs","hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-o-6b45fe","ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA","Hackers have used a third-party ScreenConnect extension, RMM+, to deploy malware onto at least 288 machines across 48 organizations. The flaw in RMM+ versions 1.0.31 and 1.0.32 allows attackers to bypass MFA by using a blank access key. ConnectWise has disabled affected extensions in approximately 400 environments and is investigating the unauthorized access.","Hackers exploit ScreenConnect plugin flaw to spread SCKit malware across hundreds of PCs.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F12\u002Fhackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs\u002F5309361","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5294333&width=800","2026-11-12T13:02:00+00:00","2026-11-12T14:00:16.580642+00:00",8,[17,20,22,25],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":19},"RMM+",{"name":23,"type":24},"ConnectWise","vendor",{"name":26,"type":27},"MFA","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":32,"value":53,"context":54},"SCKit","Malware toolkit deployed by attackers",[23,18,21],{"controls":57,"vendors":144},[58,87,115],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,107],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":88,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[145],{"slug":129,"name":130,"logo_path":131,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"blank-access-key-bypass-in-third-party-rmm-plugin-enables-mass-malware-deployment","Blank Access Key Bypass in Third-Party RMM Plugin Enables Mass Malware Deployment","A flaw in the third-party RMM+ plugin for ScreenConnect allowed attackers to completely bypass multi-factor authentication simply by submitting a blank access key — a critical authentication logic failure that required no sophisticated exploitation. Because RMM tools operate with broad, trusted access across managed endpoints, a single compromised plugin cascaded malware across 288 machines in 48 separate organizations. This incident illustrates how third-party extensions and plugins inherit the trust and reach of the platforms they extend, making their security posture as important as the core product's. Organizations that rely on remote monitoring and management tools must treat every plugin or extension as a potential attack surface subject to the same vetting rigor as the primary software.",[153,154,155,156,157],"CIS Control 16: Application Software Security (v8)","NIST SP 800-53 IA-2: Identification and Authentication (Organizational Users)","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(j)","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(d)":159,"NIS2 Article 21(2)(j)":160,"MITRE ATT&CK T1078: Valid Accounts":161,"CIS Control 16: Application Software Security (v8)":162,"NIST SP 800-53 IA-2: Identification and Authentication (Organizational Users)":163},"This point specifically covers supply chain security, and the incident originated through a third-party plugin that organizations trusted without adequate security vetting.","This point requires robust multi-factor authentication and secure communications; the blank access key exploit directly undermined MFA enforcement on the ScreenConnect platform.","Attackers exploited the authentication bypass to gain access as if they were legitimate users, which is exactly the technique T1078 describes — abusing valid or seemingly valid credentials to avoid detection.","This control requires organizations to manage the security of software, including third-party components, which directly applies because the vulnerable RMM+ plugin introduced an authentication bypass into a trusted management platform.","IA-2 requires that authentication mechanisms cannot be trivially bypassed; the blank access key flaw violated this by allowing MFA to be circumvented without any valid credential."]