Third-Party ScreenConnect Add-On Abused to Bypass Auth and Deploy Rogue RMM Tools
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited a third-party ScreenConnect extension (RMM+) to bypass authentication and spread rogue remote-management software to nearly 300 systems across 48 organizations — without compromising ConnectWise's core infrastructure. This highlights a critical blind spot: organizations often scrutinize the primary vendor but neglect the security posture of third-party plugins and extensions that plug into trusted platforms. Because these add-ons inherit the trust and access of the host platform, a vulnerable or malicious extension can effectively become an open door into managed endpoints. The incident demonstrates that supply chain risk extends beyond software vendors to any third-party component integrated into an operational toolchain.
Tactical Insight
Immediate actions
- Audit and inventory all third-party extensions, add-ons, and plugins installed in remote management platforms and disable any that are unverified or unnecessary.
- Apply ConnectWise's recommended mitigations and remove the five disabled extensions from all affected deployments immediately.
- Review authentication logs for ScreenConnect environments to identify any unauthorized access or lateral movement indicative of SCKit activity.
Long-term improvements
- Establish a formal vetting process for third-party extensions before allowing installation into production remote-access or RMM platforms.
- Enforce a least-privilege model so that add-ons operate with the minimum permissions required and cannot autonomously install software on managed endpoints.
- Maintain a continuously updated software inventory that includes plugins and extensions, not just primary applications.
Detection measures
- Deploy behavioral monitoring to alert on unexpected installation of remote-management software initiated from RMM platforms or their add-ons.
- Subscribe to vendor security advisories for all RMM tools in use, including communications about third-party extensions, to enable rapid response to newly disclosed threats.