[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTf_S4woKaYlblQDa_xgQVw9eVQcdSrnQuRoSzlnXPOQ":3},{"article":4,"iocs":51,"watch_terms":55,"solutions":56,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"ce00ef7c-ab95-4234-85fe-f947b75f3601","Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations","hackers-hijack-connectwise-screenconnect-to-deploy-sckit-malware-across-288-devi-8728dc","Attackers have taken over cloud-hosted ScreenConnect panels and used them to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations. Security firm Huntress first saw the activity on November 11, 2026, and says all 288 hosts were hit within about 90 minutes. Huntress reports that about one third of […] The post Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations appeared first on Cyber Security News.","Attackers have compromised cloud-hosted ConnectWise ScreenConnect panels to deploy a custom toolkit named SCKit to at least 288 managed devices across 48 organizations. The activity, first observed on November 11, 2026, saw all affected hosts compromised within approximately 90 minutes. The attackers leveraged the Run command feature with SYSTEM privileges to install SCKit, which includes scripts to establish persistence and add exclusions to Microsoft Defender. ConnectWise has disabled five potentially related extensions and is investigating the incident, stating no signs of their own systems being breached or a flaw in ScreenConnect itself.","Hackers exploit ConnectWise ScreenConnect to deploy SCKit malware on 288 devices.","https:\u002F\u002Fcybersecuritynews.com\u002Fconnectwise-screenconnect-hijacked\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FConnectWise-ScreenConnect-Hijacked.webp","2026-11-12T03:57:06+00:00","2026-11-12T04:00:24.43984+00:00",8,[17,20,23,25],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"Microsoft Defender",{"name":26,"type":27},"AI","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":32,"value":53,"context":54},"SCKit","Custom toolkit deployed by attackers",[21,18,24],{"controls":57,"vendors":141},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":59,"product_name":83,"url":84,"description":85},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":87,"name":88,"problem":89,"products":90},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":137,"product_name":138,"url":139,"description":140},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[142],{"slug":92,"name":93,"logo_path":94,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":154},"compromised-screenconnect-panels-used-to-mass-deploy-malware-across-48-organizations-in-90-minutes","Compromised ScreenConnect Panels Used to Mass-Deploy Malware Across 48 Organizations in 90 Minutes","Attackers who gained access to cloud-hosted ConnectWise ScreenConnect management panels were able to abuse the legitimate Run command feature—executed with SYSTEM privileges—to deploy the SCKit malware toolkit across 288 devices in roughly 90 minutes. The root issue was that whoever controlled those panels had effectively unrestricted administrative access to all managed endpoints beneath them, meaning a single point of compromise cascaded instantly across dozens of organizations. SCKit then added Microsoft Defender exclusions to entrench persistence, amplifying the damage. This incident illustrates how remote management tools, while operationally powerful, represent an extremely high-value attack surface: compromising one panel equals compromising every device it manages. Organizations relying on third-party RMM tooling must treat panel credentials and access controls as crown-jewel assets.",[150,151,152,153],"CIS Control 6: Access Control Management","NIST SP 800-53 SI-4: System Monitoring","NIS2 Article 21(2)(i)","MITRE ATT&CK T1219: Remote Access Software",{"NIS2 Article 21(2)(i)":155,"NIST SP 800-53 SI-4: System Monitoring":156,"CIS Control 6: Access Control Management":157,"MITRE ATT&CK T1219: Remote Access Software":158},"This point requires human resources security, access control, and asset management policies; applying strict access control to the high-privilege Run command feature in ScreenConnect panels would have been mandated under this obligation.","This control requires monitoring information systems for attacks; alerting on mass simultaneous command execution across hundreds of managed endpoints would have detected the campaign within its 90-minute window.","This control requires MFA and rigorous access management for all accounts; requiring MFA on ScreenConnect panel logins would have made it significantly harder for attackers to hijack those panels in the first place.","This technique describes adversary abuse of legitimate remote access tools to maintain control and execute commands; attackers directly weaponized ScreenConnect's built-in Run command to deploy SCKit at scale."]