[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPz2iNVv9Ye9sZ3DMxmntC_J2_cA7T8A6WMlmVmpq3NE":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"8fd5b80b-4af0-43a6-ac3d-28c3e0cb54e6","SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints","sckit-worm-installs-rogue-screenconnect-clients-and-session-cookie-relays-across-8b7344","Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.","Attackers are exploiting a critical authentication flaw in the RMM+ ScreenConnect extension (versions 1.0.31 and 1.0.32) to install rogue ScreenConnect clients and a toolkit called SCKit on managed endpoints. This vulnerability allows attackers to bypass ScreenConnect's security measures by using a blank access key. At least 288 hosts across 48 organizations have been affected, with ConnectWise disabling several third-party extensions as a precaution.","SCKit worm installs rogue ScreenConnect clients and session cookie relays across hundreds of endpoints.","https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fsckit-worm-rogue-screenconnect","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F266936e4b61b4dd6821599adf741b9db","2026-11-12T02:00:00+00:00","2026-11-12T08:00:42.904146+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"RMM+","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":29,"value":50,"context":51},"SCKit","Toolkit installed by attackers on compromised endpoints.",[21,18,24],{"controls":54,"vendors":139},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":135,"product_name":136,"url":137,"description":138},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[140],{"slug":77,"name":78,"logo_path":79,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"blank-access-key-flaw-in-screenconnect-extension-lets-attackers-hijack-hundreds-of-endpoints","Blank Access Key Flaw in ScreenConnect Extension Lets Attackers Hijack Hundreds of Endpoints","Attackers exploited a critical authentication bypass vulnerability in the RMM+ ScreenConnect extension, where a blank access key was sufficient to circumvent security controls — a fundamental access control failure. Because RMM tools have privileged access to managed endpoints by design, a single compromised extension cascaded across 288 hosts in 48 organizations. The flaw existed in specific versions (1.0.31 and 1.0.32) that remained deployed in production environments, highlighting the danger of unpatched third-party extensions within trusted remote management platforms. This incident demonstrates that supply-chain-adjacent tooling — third-party extensions that plug into critical infrastructure — can become a force multiplier for attackers when not rigorously maintained and monitored.",[148,149,150,151,152],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 IA-3: Device Identification and Authentication","NIS2 Article 21(2)(e)","MITRE ATT&CK T1133: External Remote Services",{"NIS2 Article 21(2)(e)":154,"MITRE ATT&CK T1133: External Remote Services":155,"CIS Control 7: Continuous Vulnerability Management":156,"CIS Control 2: Inventory and Control of Software Assets":157,"NIST SP 800-53 IA-3: Device Identification and Authentication":158},"This point requires organizations to address security in acquisition and maintenance of systems including vulnerability handling, which applies directly to the failure to patch a critical authentication flaw in a third-party extension.","Attackers abused a legitimate remote management tool (ScreenConnect) by installing rogue clients, which is precisely the technique this ATT&CK entry covers — adversaries leveraging external remote services to maintain access across endpoints.","Regularly scanning for and remediating known vulnerabilities in third-party extensions would have identified the authentication bypass flaw in versions 1.0.31 and 1.0.32 before exploitation.","Maintaining an inventory of authorized software — including third-party extensions — would have flagged unvetted or outdated versions of the RMM+ extension before attackers could exploit them.","This control requires that devices and software components authenticate using valid credentials, which would have prevented the blank access key from being accepted as a legitimate authenticator."]