[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRcsaj9CiWYKR2KbKMpCEj2waF2wTBy9hsdFH56hrC0s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"185a2650-d984-4b03-8eca-35b0743838ed","blank-access-key-flaw-in-screenconnect-extension-lets-attackers-hijack-hundreds-of-endpoints","8fd5b80b-4af0-43a6-ac3d-28c3e0cb54e6","Blank Access Key Flaw in ScreenConnect Extension Lets Attackers Hijack Hundreds of Endpoints","Attackers exploited a critical authentication bypass vulnerability in the RMM+ ScreenConnect extension, where a blank access key was sufficient to circumvent security controls — a fundamental access control failure. Because RMM tools have privileged access to managed endpoints by design, a single compromised extension cascaded across 288 hosts in 48 organizations. The flaw existed in specific versions (1.0.31 and 1.0.32) that remained deployed in production environments, highlighting the danger of unpatched third-party extensions within trusted remote management platforms. This incident demonstrates that supply-chain-adjacent tooling — third-party extensions that plug into critical infrastructure — can become a force multiplier for attackers when not rigorously maintained and monitored.","**Immediate actions:**\n- Upgrade or remove RMM+ ScreenConnect extension versions 1.0.31 and 1.0.32 immediately and audit all third-party extensions for known vulnerabilities.\n- Audit all ScreenConnect client installations across managed endpoints to identify and remove any rogue or unauthorized instances.\n- Rotate and enforce strong, non-blank access keys for all ScreenConnect and RMM tool configurations.\n\n**Long-term improvements:**\n- Establish a formal vetting and patch-tracking process for every third-party plugin or extension integrated into your RMM or remote access platform.\n- Apply least-privilege principles to RMM tools so that compromised extensions cannot propagate actions across all managed endpoints without additional authorization.\n- Maintain a continuously updated inventory of all remote access software and extensions deployed in your environment.\n\n**Detection measures:**\n- Deploy behavioral monitoring to alert on unexpected ScreenConnect client installations or new remote session relays appearing on endpoints.\n- Implement network-level logging of outbound connections from managed endpoints to detect session cookie relay activity indicative of SCKit-style toolkits.\n- Subscribe to security advisories from your RMM and remote access vendors so critical extension vulnerabilities trigger an immediate response workflow.",[12,13,14,15,16],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 IA-3: Device Identification and Authentication","NIS2 Article 21(2)(e)","MITRE ATT&CK T1133: External Remote Services",{"NIS2 Article 21(2)(e)":18,"MITRE ATT&CK T1133: External Remote Services":19,"CIS Control 7: Continuous Vulnerability Management":20,"CIS Control 2: Inventory and Control of Software Assets":21,"NIST SP 800-53 IA-3: Device Identification and Authentication":22},"This point requires organizations to address security in acquisition and maintenance of systems including vulnerability handling, which applies directly to the failure to patch a critical authentication flaw in a third-party extension.","Attackers abused a legitimate remote management tool (ScreenConnect) by installing rogue clients, which is precisely the technique this ATT&CK entry covers — adversaries leveraging external remote services to maintain access across endpoints.","Regularly scanning for and remediating known vulnerabilities in third-party extensions would have identified the authentication bypass flaw in versions 1.0.31 and 1.0.32 before exploitation.","Maintaining an inventory of authorized software — including third-party extensions — would have flagged unvetted or outdated versions of the RMM+ extension before attackers could exploit them.","This control requires that devices and software components authenticate using valid credentials, which would have prevented the blank access key from being accepted as a legitimate authenticator.","published","2026-11-12T08:21:35.604547+00:00","2026-11-12T08:21:35.593+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fsckit-worm-rogue-screenconnect","sckit-worm-installs-rogue-screenconnect-clients-and-session-cookie-relays-across-8b7344","SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]