[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7eYvTIUU6Pou4E7ukFY5MVzjwcuCEznbUsiB--UC2KQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"b9014c42-589c-4ff5-9d77-29e7bb58f3c9","blank-access-key-bypass-in-third-party-rmm-plugin-enables-mass-malware-deployment","f1be62a7-c6a2-4a1d-bc0c-4cf78dddc8c6","Blank Access Key Bypass in Third-Party RMM Plugin Enables Mass Malware Deployment","A flaw in the third-party RMM+ plugin for ScreenConnect allowed attackers to completely bypass multi-factor authentication simply by submitting a blank access key — a critical authentication logic failure that required no sophisticated exploitation. Because RMM tools operate with broad, trusted access across managed endpoints, a single compromised plugin cascaded malware across 288 machines in 48 separate organizations. This incident illustrates how third-party extensions and plugins inherit the trust and reach of the platforms they extend, making their security posture as important as the core product's. Organizations that rely on remote monitoring and management tools must treat every plugin or extension as a potential attack surface subject to the same vetting rigor as the primary software.","**Immediate actions:**\n- Audit all third-party plugins and extensions installed in your RMM environment and remove or disable any that are not strictly necessary.\n- Verify that MFA enforcement cannot be bypassed by empty, null, or default credential values in any authentication flow.\n- Apply ConnectWise's remediation steps immediately and confirm affected RMM+ versions 1.0.31 and 1.0.32 are disabled or updated.\n\n**Long-term improvements:**\n- Establish a formal vetting and approval process for any third-party plugin before it is permitted in production RMM environments.\n- Restrict RMM tool access to known, authorized IP ranges and enforce least-privilege principles on all managed endpoints.\n- Require vendors of third-party extensions to provide timely security advisories and maintain a current software bill of materials (SBOM).\n\n**Detection measures:**\n- Monitor RMM platforms for anomalous authentication events, including logins with blank or unexpected credential fields.\n- Deploy endpoint detection to alert on unusual processes or lateral movement originating from RMM agent activity.\n- Correlate RMM access logs across managed endpoints to detect simultaneous or bulk deployment actions indicative of compromise.",[12,13,14,15,16],"CIS Control 16: Application Software Security (v8)","NIST SP 800-53 IA-2: Identification and Authentication (Organizational Users)","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(j)","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(d)":18,"NIS2 Article 21(2)(j)":19,"MITRE ATT&CK T1078: Valid Accounts":20,"CIS Control 16: Application Software Security (v8)":21,"NIST SP 800-53 IA-2: Identification and Authentication (Organizational Users)":22},"This point specifically covers supply chain security, and the incident originated through a third-party plugin that organizations trusted without adequate security vetting.","This point requires robust multi-factor authentication and secure communications; the blank access key exploit directly undermined MFA enforcement on the ScreenConnect platform.","Attackers exploited the authentication bypass to gain access as if they were legitimate users, which is exactly the technique T1078 describes — abusing valid or seemingly valid credentials to avoid detection.","This control requires organizations to manage the security of software, including third-party components, which directly applies because the vulnerable RMM+ plugin introduced an authentication bypass into a trusted management platform.","IA-2 requires that authentication mechanisms cannot be trivially bypassed; the blank access key flaw violated this by allowing MFA to be circumvented without any valid credential.","published","2026-11-12T15:22:36.132268+00:00","2026-11-12T15:22:36.11+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F12\u002Fhackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs\u002F5309361","hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-o-6b45fe","Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]