Active ScreenConnect attacks breach MSPs, impact dozens of organizations

At 17:47 UTC on November 11, Huntress analysts watching cloud-hosted ScreenConnect panels saw something they had never seen before: Run Command instructions that silently installed a second, attacker-controlled ScreenConnect client on managed endpoints. Within hours the count reached six compromised MSPs, 288 endpoints, and 48 downstream organizations — numbers that kept climbing as the firm's sensors lit up across the supply chain. ConnectWise, which owns ScreenConnect, said the activity touched a "limited number" of partners and insisted there was no evidence of a vulnerability in its own code or infrastructure. Instead, the company pointed to five third-party extensions from the ScreenConnect marketplace, disabling them across roughly 400 partner environments as a precaution. Each extension carries an API that can execute remote commands, protected only by a passphrase the partner sets during installation.

The malware Huntress calls SCKit does not rely on a fresh exploit. Researchers Ben Nahorney and Susannah Matt described a two-stage worm: a Base64-encoded dropper fetches a PowerShell payload that adds Microsoft Defender exclusions, plants a scheduled task named TrapWatch, swaps the legitimate ScreenConnect client for an attacker-controlled copy, and opens a relay that captures session cookies. More unsettling is the reverse-pivot capability Huntress reconstructed from the payloads: when a technician connects to an infected endpoint, the rogue client can compromise the technician's workstation, then use that workstation's panel to reach every other machine the MSP manages. Huntress stressed that not every function has been observed in the wild; parts were pieced together from static analysis.

ConnectWise's advisory stopped short of confirming the reverse pivot, saying the assessment and the reports of technician compromise still need validation. The company also emphasized that merely having the five disabled extensions installed does not prove a network was breached. Huntress, for its part, has not identified the initial access vector — Spike Brandt, the firm's Principal Threat Intelligence Incident Commander, told BleepingComputer the activity looks like abuse of legitimate functionality aided by custom tooling compiled on the victim's machine, but "we have no information about how a 'patient zero' computer or machine would have initiated this attack." Earlier telemetry points to compromised credentials or hijacked support sessions, and a July campaign that used phishing lures imitating Social Security Administration statements to drop rogue ScreenConnect installers suggests the actors have been probing the ecosystem for months.

For MSPs and their customers, the practical fallout is already clear: resetting a stolen password does nothing to evict a rogue client that has already been planted on hundreds of PCs. Each infected endpoint remains open to the attacker until someone finds and removes the unauthorized client. ConnectWise urged on-premises partners to disable the five extensions manually, preserve suspicious-activity logs, and watch for the indicators of compromise it published. Huntress advised avoiding interactive sessions with suspected devices, revoking active sessions, and resetting credentials from a known-clean machine. The campaign illustrates how a single trusted remote-management platform can become a force multiplier for adversaries — and how little visibility most MSPs have once an attacker is already inside the console.