[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnFzdlxsD3uoCp9OjbABpFwqgXJiybVX55Rs7JbNOtsc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"5daf6a3f-3a16-4e37-8ab0-5b2add0e6213","third-party-screenconnect-add-on-abused-to-bypass-auth-and-deploy-rogue-rmm-tools","154e82c4-a558-4a15-b07c-4585bd6380f4","Third-Party ScreenConnect Add-On Abused to Bypass Auth and Deploy Rogue RMM Tools","Attackers exploited a third-party ScreenConnect extension (RMM+) to bypass authentication and spread rogue remote-management software to nearly 300 systems across 48 organizations — without compromising ConnectWise's core infrastructure. This highlights a critical blind spot: organizations often scrutinize the primary vendor but neglect the security posture of third-party plugins and extensions that plug into trusted platforms. Because these add-ons inherit the trust and access of the host platform, a vulnerable or malicious extension can effectively become an open door into managed endpoints. The incident demonstrates that supply chain risk extends beyond software vendors to any third-party component integrated into an operational toolchain.","**Immediate actions:**\n- Audit and inventory all third-party extensions, add-ons, and plugins installed in remote management platforms and disable any that are unverified or unnecessary.\n- Apply ConnectWise's recommended mitigations and remove the five disabled extensions from all affected deployments immediately.\n- Review authentication logs for ScreenConnect environments to identify any unauthorized access or lateral movement indicative of SCKit activity.\n\n**Long-term improvements:**\n- Establish a formal vetting process for third-party extensions before allowing installation into production remote-access or RMM platforms.\n- Enforce a least-privilege model so that add-ons operate with the minimum permissions required and cannot autonomously install software on managed endpoints.\n- Maintain a continuously updated software inventory that includes plugins and extensions, not just primary applications.\n\n**Detection measures:**\n- Deploy behavioral monitoring to alert on unexpected installation of remote-management software initiated from RMM platforms or their add-ons.\n- Subscribe to vendor security advisories for all RMM tools in use, including communications about third-party extensions, to enable rapid response to newly disclosed threats.",[12,13,14,15,16],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","MITRE ATT&CK T1219: Remote Access Software","CIS Control 6: Access Control Management (v8)",{"NIS2 Article 21(2)(d)":18,"MITRE ATT&CK T1219: Remote Access Software":19,"CIS Control 6: Access Control Management (v8)":20,"NIST SP 800-53 SA-9: External System Services":21,"CIS Control 2: Inventory and Control of Software Assets (v8)":22},"NIS2's supply chain security point requires organizations to assess the security of third-party components in their ICT supply chain, directly addressing the risk posed by unvetted ScreenConnect extensions.","SCKit's core technique was deploying rogue remote-management tools through the abused extension, matching ATT&CK's categorization of adversary-controlled remote access software as a persistence and control mechanism.","The attack succeeded by bypassing authentication through the add-on, which stricter access control enforcement and regular review of authentication mechanisms on RMM platforms would have helped prevent.","SA-9 requires organizations to define and enforce security requirements for external services and components, which would apply to third-party add-ons integrated into trusted RMM platforms like ScreenConnect.","This control requires maintaining an inventory of all authorized software — including plugins and extensions — which would have flagged RMM+ as an unvetted third-party add-on before it could be weaponized.","published","2026-11-12T21:20:21.122606+00:00","2026-11-12T21:20:21.093+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcyberscoop.com\u002Fconnectwise-screenconnect-sckit-attack\u002F","rogue-remote-access-campaign-spread-through-screenconnect-add-on-researchers-say-bea9d2","Rogue remote-access campaign spread through ScreenConnect add-on, researchers say",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]