[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2c5L15R5kllW2gGbiakmwjnJOiDlqm4Bur7x__-aq4c":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"3f87a384-af49-4fbe-87c5-e95313d39159","Hackers Deploy Malware in Fresh ScreenConnect Campaign","hackers-deploy-malware-in-fresh-screenconnect-campaign-e9d69b","The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The post Hackers Deploy Malware in Fresh ScreenConnect Campaign appeared first on SecurityWeek.","A threat actor has compromised hundreds of endpoints in a fresh campaign by exploiting a vulnerability in the RMM+ ScreenConnect extension. The attackers used the flaw to bypass authentication and deploy a malware toolkit called SCKit, which provides backdoor access and can self-replicate. ConnectWise has disabled several RMM+ family extensions to mitigate the threat.","Hackers exploit RMM+ extension vulnerability to deploy SCKit malware via ScreenConnect.","https:\u002F\u002Fwww.securityweek.com\u002Fhackers-deploy-malware-in-fresh-screenconnect-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F02\u002FConnectWise.jpeg","2026-11-12T10:39:34+00:00","2026-11-12T11:00:22.782049+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":19},"RMM+",{"name":23,"type":24},"ConnectWise","vendor",{"name":26,"type":27},"extension","technology",{"name":29,"type":27},"backdoor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":34,"value":55,"context":56},"SCKit","Malware toolkit deployed by attackers for backdoor access and session cookie interception.",[23,18,21],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":90,"name":91,"problem":92,"products":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[148],{"slug":132,"name":133,"logo_path":134,"roles":149},[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":161},"authentication-bypass-in-screenconnect-rmm-extension-enables-mass-endpoint-compromise","Authentication Bypass in ScreenConnect RMM Extension Enables Mass Endpoint Compromise","Attackers exploited an unpatched authentication bypass vulnerability in the ScreenConnect RMM+ extension to compromise hundreds of endpoints, deploying a self-replicating backdoor toolkit called SCKit. Remote Monitoring and Management (RMM) tools are high-value targets because they already have privileged, broad access across managed endpoints — a single flaw can cascade into enterprise-wide compromise. The delay between vulnerability disclosure and patching (or disabling) the affected extension gave attackers a critical window to operate. ConnectWise's decision to disable the RMM+ extensions entirely illustrates how dangerous unmitigated vulnerabilities in privileged remote-access tools can be. Organizations relying on third-party RMM solutions must treat them as critical attack surface requiring continuous vulnerability tracking.",[156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1190: Exploit Public-Facing Application","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"MITRE ATT&CK T1190: Exploit Public-Facing Application":164,"CIS Control 7: Continuous Vulnerability Management (v8)":165,"CIS Control 2: Inventory and Control of Software Assets (v8)":166},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling — operators using the ScreenConnect extension were obligated to track and remediate this vulnerability as part of their supply-side software security processes.","SI-2 requires organizations to identify, report, and correct information system flaws — a formal flaw remediation process would have accelerated patching of the ScreenConnect authentication bypass before exploitation occurred.","The attackers exploited a publicly known vulnerability in the internet-exposed ScreenConnect RMM+ extension to gain initial access, which is precisely the technique T1190 describes.","CIS Control 7 requires continuous scanning and timely remediation of vulnerabilities in software like RMM extensions — had this been in place, the authentication bypass flaw would have been identified and patched before attackers could exploit it.","CIS Control 2 requires organizations to maintain an authoritative inventory of all authorized software and extensions, which would have ensured the vulnerable RMM+ extension was tracked and subject to patching oversight."]