[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRD_55jmUPP4v3-RWdz91ojBfMB1ubg5xOgJnRhn5O5E":3},{"article":4,"iocs":35,"watch_terms":36,"solutions":37,"lesson":12},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"4ee566c6-b324-4e38-a1f3-fbb3811cd622","Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes","huntress-uncovers-sckit-rogue-screenconnect-toolkit-hits-288-hosts-in-90-minutes-b71e75","Huntress researchers have detailed a fast-moving campaign in which attackers abused cloud-hosted ScreenConnect panels to install rogue clients and a custom toolkit, dubbed SCKit, on managed endpoints. At least 288 hosts across 48 Huntress-protected organisations were affected within around 90 minutes on 11 November, with roughly a third compromised in the first ten minutes. Rather […] The post Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes appeared first on IT Security Guru.","Huntress researchers have detailed a fast-moving campaign where attackers abused cloud-hosted ScreenConnect panels to install rogue clients and a custom toolkit, SCKit, on managed endpoints. At least 288 hosts across 48 organizations were affected within 90 minutes on November 11th.","Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F11\u002F12\u002Fhuntress-uncovers-sckit-rogue-screenconnect-toolkit-hits-288-hosts-in-90-minutes\u002F?utm_source=rss&utm_medium=rss&utm_campaign=huntress-uncovers-sckit-rogue-screenconnect-toolkit-hits-288-hosts-in-90-minutes",null,"2026-11-12T11:34:07+00:00","2026-11-12T17:00:19.107642+00:00",7,[17],{"name":18,"type":19},"ScreenConnect","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":12,"name":22,"slug":23},"Malware","malware",[25,30],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":38,"vendors":123},[39,68,94],{"slug":40,"name":41,"problem":42,"products":43},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[44,52,60],{"vendor_slug":45,"vendor_name":46,"vendor_logo":47,"product_slug":48,"product_name":49,"url":50,"description":51},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":69,"name":70,"problem":71,"products":72},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[73,81,86],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":82,"product_name":83,"url":84,"description":85},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[124],{"slug":45,"name":46,"logo_path":47,"roles":125},[126],"reported_by"]