[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbkspDtpwLg1brgKjhOFlVX--MhkYoPfM7h4MGBcypZw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"2ea65a9a-b85a-40a3-8d9b-e34e9b480aeb","rogue-screenconnect-clients-deployed-via-compromised-panels-and-third-party-extensions","ec0d78f2-30b2-4014-9428-d05347e6e679","Rogue ScreenConnect Clients Deployed via Compromised Panels and Third-Party Extensions","Threat actors exploited compromised credentials or hijacked sessions to gain access to ScreenConnect administrative panels, then leveraged rogue third-party extensions to push malicious clients to at least 288 endpoints across 48 organizations. The root issue is not a vulnerability in ScreenConnect itself, but rather weak access controls around the administrative interface and insufficient vetting of third-party extensions. This matters because remote management tools are high-value targets — control over the management plane means control over every endpoint it manages. Organizations that treat RMM tools as inherently trusted without layering additional access controls are exposed to cascading compromise at scale.","**Immediate actions:**\n- Rotate all ScreenConnect administrative credentials immediately and audit active sessions for unauthorized access.\n- Disable or remove untrusted third-party extensions from your ScreenConnect instance pending security review.\n- Enable MFA on all ScreenConnect administrative accounts if not already in place.\n\n**Long-term improvements:**\n- Restrict administrative panel access to known IP ranges or VPN-only connections to reduce exposure.\n- Establish a formal vetting and approval process for any third-party extensions or plugins used in RMM tools.\n- Treat your RMM platform as critical infrastructure with dedicated access controls, audit logging, and change management.\n\n**Detection measures:**\n- Monitor ScreenConnect logs for unusual client deployments, new extension installations, or admin logins from unexpected locations.\n- Set up alerting for bulk client pushes or configuration changes occurring outside of normal change windows.\n- Correlate RMM activity logs with endpoint detection data to identify rogue client behavior early.",[12,13,14,15,16],"CIS Control 6: Access Control Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 AC-17: Remote Access","NIS2 Article 21(2)(i)","MITRE ATT&CK T1219: Remote Access Software",{"NIS2 Article 21(2)(i)":18,"NIST SP 800-53 AC-17: Remote Access":19,"MITRE ATT&CK T1219: Remote Access Software":20,"CIS Control 6: Access Control Management (v8)":21,"CIS Control 2: Inventory and Control of Software Assets (v8)":22},"This point covers access control and asset management, directly addressing the failure to protect administrative credentials and control who could access the ScreenConnect management plane.","This control requires monitoring and controlling all remote access methods; applying it to the ScreenConnect admin panel would have enforced IP restrictions and session controls that limit attacker access.","This technique describes adversaries abusing legitimate remote access tools like ScreenConnect to maintain persistence and control endpoints, which is exactly how the rogue clients were deployed in this incident.","This control requires managing and restricting access to administrative systems; stronger credential hygiene and MFA on the ScreenConnect panel would have prevented initial unauthorized access.","This control requires organizations to track and authorize software, including extensions; a formal inventory and approval process for third-party ScreenConnect extensions would have blocked the malicious plugins.","published","2026-11-12T06:21:14.566112+00:00","2026-11-12T06:21:14.47+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fscreenconnect-attacks-target-at-least.html","screenconnect-attacks-target-at-least-288-endpoints-across-48-organizations-with-0a7fd3","ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]