[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhIrwtEVaq_9TDPGxdkgSzOrbjj41dCTW7DpAtJuZvvY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":16,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"4c3561bd-c93c-4db3-8b06-aee1e775feb9","compromised-screenconnect-panels-used-to-mass-deploy-malware-across-48-organizations-in-90-minutes","ce00ef7c-ab95-4234-85fe-f947b75f3601","Compromised ScreenConnect Panels Used to Mass-Deploy Malware Across 48 Organizations in 90 Minutes","Attackers who gained access to cloud-hosted ConnectWise ScreenConnect management panels were able to abuse the legitimate Run command feature—executed with SYSTEM privileges—to deploy the SCKit malware toolkit across 288 devices in roughly 90 minutes. The root issue was that whoever controlled those panels had effectively unrestricted administrative access to all managed endpoints beneath them, meaning a single point of compromise cascaded instantly across dozens of organizations. SCKit then added Microsoft Defender exclusions to entrench persistence, amplifying the damage. This incident illustrates how remote management tools, while operationally powerful, represent an extremely high-value attack surface: compromising one panel equals compromising every device it manages. Organizations relying on third-party RMM tooling must treat panel credentials and access controls as crown-jewel assets.","**Immediate actions:**\n- Rotate all ScreenConnect panel credentials immediately and audit which accounts have administrative access to the Run command feature.\n- Review and restrict Defender exclusion policies so that endpoint protection settings cannot be altered without a separate privileged approval workflow.\n- Audit installed extensions on all ScreenConnect instances and remove or disable any that are unrecognized or unnecessary.\n\n**Long-term improvements:**\n- Enforce multi-factor authentication on all remote management panel logins and apply the principle of least privilege so operators only access the device groups they manage.\n- Segment RMM infrastructure so that a single compromised panel cannot reach devices belonging to multiple distinct organizations without additional authentication boundaries.\n- Establish a formal third-party\u002Fmanaged-tool risk policy requiring periodic access reviews and contractual security obligations for cloud-hosted management platforms.\n\n**Detection measures:**\n- Deploy behavioral monitoring to alert on mass execution of the same command across large numbers of managed endpoints within a short time window.\n- Log and alert on any changes to antivirus exclusion lists, treating such changes as high-severity events requiring immediate review.\n- Correlate RMM command logs with endpoint telemetry to detect unauthorized or anomalous use of privileged remote execution features.",[12,13,14,15],"CIS Control 6: Access Control Management","NIST SP 800-53 SI-4: System Monitoring","NIS2 Article 21(2)(i)","MITRE ATT&CK T1219: Remote Access Software",{"NIS2 Article 21(2)(i)":17,"NIST SP 800-53 SI-4: System Monitoring":18,"CIS Control 6: Access Control Management":19,"MITRE ATT&CK T1219: Remote Access Software":20},"This point requires human resources security, access control, and asset management policies; applying strict access control to the high-privilege Run command feature in ScreenConnect panels would have been mandated under this obligation.","This control requires monitoring information systems for attacks; alerting on mass simultaneous command execution across hundreds of managed endpoints would have detected the campaign within its 90-minute window.","This control requires MFA and rigorous access management for all accounts; requiring MFA on ScreenConnect panel logins would have made it significantly harder for attackers to hijack those panels in the first place.","This technique describes adversary abuse of legitimate remote access tools to maintain control and execute commands; attackers directly weaponized ScreenConnect's built-in Run command to deploy SCKit at scale.","published","2026-11-12T04:20:21.017299+00:00","2026-11-12T04:20:20.998+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fcybersecuritynews.com\u002Fconnectwise-screenconnect-hijacked\u002F","hackers-hijack-connectwise-screenconnect-to-deploy-sckit-malware-across-288-devi-8728dc","Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[43,47,51],{"slug":44,"name":45,"problem":46},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":48,"name":49,"problem":50},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]