[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3DNBvDG7wVN4_Xp1h0V0InqJoizYk9P-uoFsKOqKH9A":3},{"article":4,"iocs":56,"watch_terms":64,"solutions":65,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"154e82c4-a558-4a15-b07c-4585bd6380f4","Rogue remote-access campaign spread through ScreenConnect add-on, researchers say","rogue-remote-access-campaign-spread-through-screenconnect-add-on-researchers-say-bea9d2","ConnectWise disabled five third-party extensions across about 400 partner environments after researchers linked a worm-like toolkit to one of them. The post Rogue remote-access campaign spread through ScreenConnect add-on, researchers say appeared first on CyberScoop.","Researchers discovered a worm-like toolkit, dubbed SCKit, that exploited a third-party ScreenConnect add-on called RMM+ to bypass authentication and install rogue remote-management software on nearly 300 computers across 48 organizations. ConnectWise disabled five extensions and stated there is no evidence of a compromise to its infrastructure or ScreenConnect itself, attributing the activity to the abuse of independent third-party extensions.","Rogue ScreenConnect add-on used to spread malware to managed endpoints.","https:\u002F\u002Fcyberscoop.com\u002Fconnectwise-screenconnect-sckit-attack\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F11\u002FGettyImages-2192531852.jpg","2026-11-12T20:58:17+00:00","2026-11-12T21:00:29.401022+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"RMM+",{"name":26,"type":27},"remote-management software","technology",{"name":29,"type":30},"Storm-0940","threat_actor",{"name":32,"type":22},"Microsoft","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60],{"type":37,"value":58,"context":59},"SCKit","Name of the malware toolkit used in the campaign.",{"type":61,"value":62,"context":63},"cve","CVE-2026-84869","Previously disclosed ScreenConnect file-transfer flaw.",[21,32,18],{"controls":66,"vendors":154},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":126,"name":127,"problem":128,"products":129},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[155],{"slug":118,"name":119,"logo_path":120,"roles":156},[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":168},"third-party-screenconnect-add-on-abused-to-bypass-auth-and-deploy-rogue-rmm-tools","Third-Party ScreenConnect Add-On Abused to Bypass Auth and Deploy Rogue RMM Tools","Attackers exploited a third-party ScreenConnect extension (RMM+) to bypass authentication and spread rogue remote-management software to nearly 300 systems across 48 organizations — without compromising ConnectWise's core infrastructure. This highlights a critical blind spot: organizations often scrutinize the primary vendor but neglect the security posture of third-party plugins and extensions that plug into trusted platforms. Because these add-ons inherit the trust and access of the host platform, a vulnerable or malicious extension can effectively become an open door into managed endpoints. The incident demonstrates that supply chain risk extends beyond software vendors to any third-party component integrated into an operational toolchain.",[163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","MITRE ATT&CK T1219: Remote Access Software","CIS Control 6: Access Control Management (v8)",{"NIS2 Article 21(2)(d)":169,"MITRE ATT&CK T1219: Remote Access Software":170,"CIS Control 6: Access Control Management (v8)":171,"NIST SP 800-53 SA-9: External System Services":172,"CIS Control 2: Inventory and Control of Software Assets (v8)":173},"NIS2's supply chain security point requires organizations to assess the security of third-party components in their ICT supply chain, directly addressing the risk posed by unvetted ScreenConnect extensions.","SCKit's core technique was deploying rogue remote-management tools through the abused extension, matching ATT&CK's categorization of adversary-controlled remote access software as a persistence and control mechanism.","The attack succeeded by bypassing authentication through the add-on, which stricter access control enforcement and regular review of authentication mechanisms on RMM platforms would have helped prevent.","SA-9 requires organizations to define and enforce security requirements for external services and components, which would apply to third-party add-ons integrated into trusted RMM platforms like ScreenConnect.","This control requires maintaining an inventory of all authorized software — including plugins and extensions — which would have flagged RMM+ as an unvetted third-party add-on before it could be weaponized."]