Hackers Deploy Malware in New ScreenConnect Campaign

The attacks were observed on 11 November, when the hackers abused unauthorized access to cloud-hosted ScreenConnect panels to run commands on managed endpoints. Huntress reports that the campaign compromised at least 6 MSPs and 288 hosts across 48 organizations, and that the attackers hit all 288 compromised hosts within 90 minutes. The commands deployed rogue ScreenConnect clients and a malware toolkit called SCKit, which provides persistent backdoor access, intercepts session cookies and can self-replicate.

The hackers likely exploited a bug in RMM+, a third-party extension for managing ScreenConnect sessions that uses a shared access key to bypass ScreenConnect authentication. According to Huntress, versions 1.0.31 and 1.0.32 of the extension accepted a blank access key when an administrator had never configured one. ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments. Huntress and ConnectWise have released indicators of compromise and recommend that organizations disable the extensions in their on-premises ScreenConnect deployments.

Why it matters Organizations that run ScreenConnect with third-party extensions should check whether RMM+ or related extensions are installed, and whether versions 1.0.31 or 1.0.32 were ever deployed with an unconfigured access key. Because the campaign reached many customers of managed service providers within a short window, investigators should review ScreenConnect panels, rogue clients and sessions of technicians for the published indicators of compromise, and treat a technician’s workstation as potentially exposed if it connected to a compromised endpoint.