SCKit campaign pushes rogue ScreenConnect clients to 288 endpoints across 48 organisations
Attackers used access to multiple cloud-hosted ConnectWise ScreenConnect panels on November 11 to push rogue software to managed endpoints, installing attacker-controlled ScreenConnect clients and a toolkit dubbed SCKit — at least 288 affected hosts across 48 organisations that use Huntress, and the full scope is still unknown.
The News
On November 11, attackers used access to multiple cloud-hosted ConnectWise ScreenConnect panels to push commands to groups of managed endpoints, installing attacker-controlled ScreenConnect clients and a toolkit dubbed SCKit. ScreenConnect is remote-management software: IT teams use it to control and fix computers from a distance, which makes it a powerful prize for an attacker who can get inside it. Huntress, the security company that first observed the activity at about 17:47 UTC on November 11, counts at least 288 affected hosts across 48 organisations that use Huntress. That count covers only Huntress-observed endpoints — the true total could be larger. Sophos, another security company, reports seeing the same method of attack.
ConnectWise responded the same evening. In an advisory posted at 22:45 UTC on November 11, the company said it had identified five independent third-party extensions that may be associated with the activity and disabled them across about 400 partner environments as a precaution. A third-party extension is an add-on built by someone other than ConnectWise that plugs into ScreenConnect. The RMM+ extension was later linked to the activity and disabled by ConnectWise. Extensions matter here because they run inside the management panel, so a compromised or abused extension can reach every computer that panel manages.
ConnectWise says there is no evidence the incident involves a compromise of its own infrastructure or a vulnerability in ScreenConnect itself, and Huntress says it has seen no evidence of a new vulnerability. Huntress has since reported the activity seems related to the RMM+ extension, whose versions 1.0.31 and 1.0.32 accepted a blank access key when none was set — but ConnectWise has not confirmed that as the entry point. That is the honest state of play a day in: the attack is real and counted, the suspected door is identified but not yet confirmed, and the count of affected organisations is a floor, not a ceiling.
288 hosts, 48 organisations, one abused management tool — and the front door is still unidentified.
Why It Matters
This matters because ScreenConnect is a force multiplier — in both directions. For an IT team, one panel manages hundreds or thousands of computers, pushing updates and running fixes remotely. For an attacker who gets into that panel, the same reach works in reverse: one push can install rogue software on every machine the panel controls. That is what happened here. The attackers did not have to break into 288 computers one by one; they used the management layer to do it in bulk. Remote-management tools are therefore among the most valuable targets in cybersecurity, and this incident is a live demonstration of why.
It also matters because of what is still unknown. Huntress has seen no evidence of a new vulnerability, and ConnectWise says there is no evidence its own infrastructure was compromised or that ScreenConnect itself has a flaw. That leaves the initial access method as an open question — and an open question is itself a risk, because defenders cannot be sure they have closed the door the attackers used. The five disabled extensions are a lead, not yet a confirmed answer: ConnectWise says they may be associated with the activity, and the RMM+ extension was later linked to it, but the investigation is still running.
For the security vendors named as read-through tickers, CrowdStrike and Palo Alto Networks, the read is mixed: neither company is involved in this incident — the affected vendor is the privately held ConnectWise, and Huntress found the campaign — so there is no direct hit to either named ticker. An active campaign like this means incident-response work and customer questions, but incidents like this also drive demand for the monitoring and response services these companies sell. The read is therefore mixed, not bearish.
Analyst's Take
Our call is Mixed. This is an active attack campaign against the very tool IT teams use to manage their computers — one compromised panel can push rogue software to every machine it controls, and the count of at least 288 hosts across 48 organisations is only what Huntress can see. But neither CrowdStrike nor Palo Alto Networks is involved in this incident — ConnectWise is privately held, and Huntress found the campaign — so there is no direct hit to either named ticker. An incident like this may even drive demand for the monitoring and response services they sell, which offsets the near-term noise. The read is therefore mixed, not bearish.
What to watch: whether the count grows beyond the Huntress-observed 288 hosts, whether ConnectWise identifies the initial access method, and whether more extensions are linked to the activity. The fast response — five extensions disabled across about 400 partner environments within hours — shows the incident is being taken seriously. But until the entry point is found and closed, every ScreenConnect user should assume they need to check their own environment rather than assume they are safe. Huntress also notes the worm-like spread SCKit was built for — jumping from an infected endpoint to a technician's workstation and on to other panels — has not been observed working: the console-takeover attempt failed in every recovered host log so far, and the infections seen came from operator commands pushed through the panels.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is ScreenConnect?
ScreenConnect is remote-management software made by ConnectWise. IT teams use it to control and fix computers from a distance — installing updates, running commands and helping users without being in the room. Because it gives remote control over many machines at once, it is a powerful tool for attackers if they can get into it.
What is SCKit?
SCKit is the name Huntress gave to the toolkit the attackers installed alongside the rogue ScreenConnect clients. It is a set of attacker tools pushed to the managed computers, or endpoints, after the attackers got access to the cloud-hosted ScreenConnect panels that manage them.
How many organisations were hit?
Huntress counts at least 288 affected hosts across 48 organisations that use Huntress — and that is only what Huntress can see. The true total could be larger, because it covers only endpoints protected by Huntress. Sophos, another security company, says it has seen the same method of attack.
Was ScreenConnect itself hacked?
ConnectWise says there is no evidence the incident involves a compromise of its own infrastructure or a vulnerability in ScreenConnect itself, and Huntress says it has seen no evidence of a new vulnerability. Instead, ConnectWise identified five independent third-party extensions that may be associated with the activity and disabled them across about 400 partner environments as a precaution. Huntress says the activity seems related to the RMM+ extension: versions 1.0.31 and 1.0.32 had a flaw where a blank access key was accepted if no key had been set, bypassing ScreenConnect accounts, roles and MFA. ConnectWise has not confirmed that as the initial access method, which remains under investigation.
What should an IT team do now?
Check whether your ScreenConnect panels and endpoints show signs of the rogue clients, review the third-party extensions installed on your panels, and follow the guidance in ConnectWise's advisory and Huntress's incident report. If you use ScreenConnect, treat this as an active incident until you have confirmed your own environment is clean.
👁
Source: Huntress