[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJPbkJH2nC9r-h7Qawe6ozRuiZFt7bU95dfwHFl3iPKw":3},{"article":4,"iocs":44,"watch_terms":63,"solutions":64,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"ec0d78f2-30b2-4014-9428-d05347e6e679","ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients","screenconnect-attacks-target-at-least-288-endpoints-across-48-organizations-with-0a7fd3","ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. \"Our initial assessment suggests the activity may involve","ConnectWise is disabling five third-party extensions after reports of unauthorized access, stating there's no evidence of a ScreenConnect vulnerability. The activity appears to involve threat actors abusing these extensions to gain access. Huntress reports attackers are using compromised ScreenConnect panels to push rogue clients, impacting at least 288 endpoints across 48 organizations, with initial access likely through compromised credentials or hijacked sessions.","Rogue ScreenConnect clients deployed via third-party extensions impact 48 organizations.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fscreenconnect-attacks-target-at-least.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgEfz7InYm8UO-p35K6B4j009BxA-MO7DdZ2x1d-xhyphenhyphenPxNnVs848IlgAGelmuW-sPbEZbE8-L9_KWEYNH_M5HaTMy14MFd87A7YkqHAzDKaamKOdpZKR9owL3nK3gbqAngvWa6A4NC1KK1l0ie9FK731LfKPI0lguiGQ1b71sHIZj2kR2H3I-GJjSPY4kJU\u002Fs1600\u002Fscreenconnect-hack.jpg","2026-11-12T04:39:48+00:00","2026-11-12T06:00:26.677522+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":25},"RMM","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,51,55,57,59,61],{"type":46,"value":47,"context":48},"ip","185.99.255.28","IP address associated with the attack",{"type":46,"value":50,"context":48},"155.94.150.39",{"type":52,"value":53,"context":54},"domain","ns.mo7sen.dev","Domain associated with the attack",{"type":52,"value":56,"context":54},"sc.payproofkit.com",{"type":52,"value":58,"context":54},"cdn007-digitaldownloads.com",{"type":52,"value":60,"context":54},"newnewnew.gotdns.org",{"type":52,"value":62,"context":54},"Soxnewwork.homedns.org",[21,18],{"controls":65,"vendors":152},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[71,78,86],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":67,"product_name":75,"url":76,"description":77},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":95,"name":96,"problem":97,"products":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[153],{"slug":154,"name":155,"logo_path":156,"roles":157},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":169},"rogue-screenconnect-clients-deployed-via-compromised-panels-and-third-party-extensions","Rogue ScreenConnect Clients Deployed via Compromised Panels and Third-Party Extensions","Threat actors exploited compromised credentials or hijacked sessions to gain access to ScreenConnect administrative panels, then leveraged rogue third-party extensions to push malicious clients to at least 288 endpoints across 48 organizations. The root issue is not a vulnerability in ScreenConnect itself, but rather weak access controls around the administrative interface and insufficient vetting of third-party extensions. This matters because remote management tools are high-value targets — control over the management plane means control over every endpoint it manages. Organizations that treat RMM tools as inherently trusted without layering additional access controls are exposed to cascading compromise at scale.",[164,165,166,167,168],"CIS Control 6: Access Control Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 AC-17: Remote Access","NIS2 Article 21(2)(i)","MITRE ATT&CK T1219: Remote Access Software",{"NIS2 Article 21(2)(i)":170,"NIST SP 800-53 AC-17: Remote Access":171,"MITRE ATT&CK T1219: Remote Access Software":172,"CIS Control 6: Access Control Management (v8)":173,"CIS Control 2: Inventory and Control of Software Assets (v8)":174},"This point covers access control and asset management, directly addressing the failure to protect administrative credentials and control who could access the ScreenConnect management plane.","This control requires monitoring and controlling all remote access methods; applying it to the ScreenConnect admin panel would have enforced IP restrictions and session controls that limit attacker access.","This technique describes adversaries abusing legitimate remote access tools like ScreenConnect to maintain persistence and control endpoints, which is exactly how the rogue clients were deployed in this incident.","This control requires managing and restricting access to administrative systems; stronger credential hygiene and MFA on the ScreenConnect panel would have prevented initial unauthorized access.","This control requires organizations to track and authorize software, including extensions; a formal inventory and approval process for third-party ScreenConnect extensions would have blocked the malicious plugins."]