Compromised ScreenConnect Panels Used to Mass-Deploy Malware Across 48 Organizations in 90 Minutes
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers who gained access to cloud-hosted ConnectWise ScreenConnect management panels were able to abuse the legitimate Run command feature—executed with SYSTEM privileges—to deploy the SCKit malware toolkit across 288 devices in roughly 90 minutes. The root issue was that whoever controlled those panels had effectively unrestricted administrative access to all managed endpoints beneath them, meaning a single point of compromise cascaded instantly across dozens of organizations. SCKit then added Microsoft Defender exclusions to entrench persistence, amplifying the damage. This incident illustrates how remote management tools, while operationally powerful, represent an extremely high-value attack surface: compromising one panel equals compromising every device it manages. Organizations relying on third-party RMM tooling must treat panel credentials and access controls as crown-jewel assets.
Tactical Insight
Immediate actions
- Rotate all ScreenConnect panel credentials immediately and audit which accounts have administrative access to the Run command feature.
- Review and restrict Defender exclusion policies so that endpoint protection settings cannot be altered without a separate privileged approval workflow.
- Audit installed extensions on all ScreenConnect instances and remove or disable any that are unrecognized or unnecessary.
Long-term improvements
- Enforce multi-factor authentication on all remote management panel logins and apply the principle of least privilege so operators only access the device groups they manage.
- Segment RMM infrastructure so that a single compromised panel cannot reach devices belonging to multiple distinct organizations without additional authentication boundaries.
- Establish a formal third-party/managed-tool risk policy requiring periodic access reviews and contractual security obligations for cloud-hosted management platforms.
Detection measures
- Deploy behavioral monitoring to alert on mass execution of the same command across large numbers of managed endpoints within a short time window.
- Log and alert on any changes to antivirus exclusion lists, treating such changes as high-severity events requiring immediate review.
- Correlate RMM command logs with endpoint telemetry to detect unauthorized or anomalous use of privileged remote execution features.