[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ff_Wb4hZSQ2Sq_n2pAGS-xNnxTQ76smVa4GHstiIsO50":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"831213dd-e34a-4e15-85db-6d0cd45d1203","authentication-bypass-in-screenconnect-rmm-extension-enables-mass-endpoint-compromise","3f87a384-af49-4fbe-87c5-e95313d39159","Authentication Bypass in ScreenConnect RMM Extension Enables Mass Endpoint Compromise","Attackers exploited an unpatched authentication bypass vulnerability in the ScreenConnect RMM+ extension to compromise hundreds of endpoints, deploying a self-replicating backdoor toolkit called SCKit. Remote Monitoring and Management (RMM) tools are high-value targets because they already have privileged, broad access across managed endpoints — a single flaw can cascade into enterprise-wide compromise. The delay between vulnerability disclosure and patching (or disabling) the affected extension gave attackers a critical window to operate. ConnectWise's decision to disable the RMM+ extensions entirely illustrates how dangerous unmitigated vulnerabilities in privileged remote-access tools can be. Organizations relying on third-party RMM solutions must treat them as critical attack surface requiring continuous vulnerability tracking.","**Immediate actions:**\n- Disable or isolate affected RMM+ ScreenConnect extensions until a vendor-confirmed patch is applied\n- Conduct a full endpoint sweep for indicators of compromise associated with the SCKit toolkit\n- Block outbound communications from RMM agents to unknown or unrecognized destinations\n\n**Long-term improvements:**\n- Maintain a complete, up-to-date inventory of all RMM tools and third-party extensions in use across the environment\n- Implement emergency patching procedures with defined SLAs for critical authentication-bypass vulnerabilities in privileged tools\n- Restrict RMM agent permissions to the minimum required scope and enforce network segmentation around management infrastructure\n\n**Detection measures:**\n- Monitor RMM platforms for anomalous authentication events, unexpected agent deployments, or lateral movement indicators\n- Deploy behavioral endpoint detection capable of identifying self-replicating malware activity consistent with SCKit\n- Subscribe to vendor security advisories and threat intelligence feeds specific to RMM and remote-access software",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1190: Exploit Public-Facing Application","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"MITRE ATT&CK T1190: Exploit Public-Facing Application":20,"CIS Control 7: Continuous Vulnerability Management (v8)":21,"CIS Control 2: Inventory and Control of Software Assets (v8)":22},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling — operators using the ScreenConnect extension were obligated to track and remediate this vulnerability as part of their supply-side software security processes.","SI-2 requires organizations to identify, report, and correct information system flaws — a formal flaw remediation process would have accelerated patching of the ScreenConnect authentication bypass before exploitation occurred.","The attackers exploited a publicly known vulnerability in the internet-exposed ScreenConnect RMM+ extension to gain initial access, which is precisely the technique T1190 describes.","CIS Control 7 requires continuous scanning and timely remediation of vulnerabilities in software like RMM extensions — had this been in place, the authentication bypass flaw would have been identified and patched before attackers could exploit it.","CIS Control 2 requires organizations to maintain an authoritative inventory of all authorized software and extensions, which would have ensured the vulnerable RMM+ extension was tracked and subject to patching oversight.","published","2026-11-12T11:20:19.752258+00:00","2026-11-12T11:20:19.724+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fhackers-deploy-malware-in-fresh-screenconnect-campaign\u002F","hackers-deploy-malware-in-fresh-screenconnect-campaign-e9d69b","Hackers Deploy Malware in Fresh ScreenConnect Campaign",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":34,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]