Skip to content
Threat Feed
Subscribe
critical threat exploited

Unauthorized Access and Rogue Client Deployment in ScreenConnect Environments

Threat actors are leveraging compromised credentials or hijacked operator sessions to gain access to ScreenConnect panels, where they deploy rogue clients and malicious toolkits for persistent access.

Triage facts

Revision 1
Applicability
ScreenConnect
Evidence
Confirmed activeHigh confidence
Severity
Critical
Sources
1 public source
Freshness
Revision 1Nov 12, 06:12 UTC
Detection
1 rule
Source quality
D2Likely

ConnectWise is investigating reports of unauthorized access to ScreenConnect environments, affecting at least 288 endpoints across 48 organizations. The activity involves the use of the 'Run Command' feature to deploy rogue ScreenConnect clients. ConnectWise has urged partners to disable five third-party extensions as a precautionary measure while investigations continue.

Attack Chain

  1. Initial Access: Attackers gain access to cloud-hosted ScreenConnect panels, likely via compromised credentials or hijacked operator sessions.
  2. Payload Delivery: Attackers utilize the 'Run Command' feature to deploy rogue ScreenConnect clients and an encrypted malicious toolkit (SCKit).
  3. Persistence and Lateral Movement: The toolkit creates a persistent backdoor, adds Microsoft Defender exclusions, and attempts to steal browser sessions and authentication tokens from connected technician workstations to pivot to other managed panels.

Recommendation

  • Disable the identified third-party extensions: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.
  • Review ScreenConnect Run Command history for unauthorized activity.
  • Monitor for suspicious sign-ins, unexpected MFA prompts, and new administrator accounts.
  • Inspect managed endpoints for the presence of unauthorized ScreenConnect clients or unexpected tools such as 'TrapWatch'.

Detection coverage 1

Suspicious ScreenConnect Run Command Activity

critical

Detects the use of Run Command to deploy suspected malicious scripts associated with the SCKit toolkit.

sigma sources: process_creation, windows

Detection queries are available on the platform. Get full rules →