Threat watch / Campaign
ScreenConnect: rogue clients pushed from cloud panels to 288 machines in 48 organizations
On November 11, 2026, an attacker used the "Run" command of cloud-hosted ScreenConnect panels to install a custom toolkit, SCKit, on at least 288 hosts across 48 organizations protected by Huntress, about a third of them in the first ten minutes. SCKit sets up its own remote access and a relay that steals ScreenConnect session cookies from technicians' workstations. ConnectWise published an advisory the same evening and, as a precaution, disabled several third-party extensions across about 400 partner environments; it had not yet identified the way in.
- Sector
- Many sectors
- Way in
- Not public yet
- Product or vendor
- ConnectWise ScreenConnect, RMM+ (third-party ScreenConnect extension)
- How it happened
- An operator ran commands through the "Run" feature of cloud-hosted ScreenConnect panels to push SCKit installs to managed endpoints, according to Huntress, which says versions 26.6.6.9747 and 26.7.6.9783 are affected. How the attacker got into the panels is not confirmed: Huntress told The Hacker News that "current telemetry points to compromised credentials or hijacked operator sessions" and that it has "not seen evidence of a new vulnerability". ConnectWise says the activity is related to abuse of an independent third-party extension, RMM+, which exposes an API for remote commands protected by a passphrase the partner sets, according to The Record; Huntress adds that RMM+ "bypasses ScreenConnect's user accounts, roles, and MFA", authenticates requests with a shared access key that versions 1.0.31 and 1.0.32 left blank by default, and that it saw no matching login activity; Blackpoint Cyber says the toolkit exploits CVE-2026-84869 and that a fully patched client blocks it. Huntress says the source code of one SCKit component, RelayTrap, appears to have been generated by a large language model.[1][3][4] Checked 14 Nov 2026
- What was stolen
- SCKit establishes persistent remote access (a rogue ScreenConnect client, a "TrapWatch" scheduled task, Microsoft Defender exclusions) and a relay trap that steals the .aspxauth session cookie from technicians' workstations and tries to replay it against the panel to reach other sessions. Huntress reconstructed this step but has not seen a successful jump to a technician workstation. What was taken from each victim is not public.[1] Checked 14 Nov 2026
- Who was impacted
- At least 288 hosts across 48 organizations that use Huntress, all hit within about 90 minutes, then 205 hosts across 41 organizations in a second wave on November 13, according to Huntress, which gives no combined total. Sophos also reports malicious ScreenConnect deployments it considers likely to come from compromised instances.[1][2] Checked 14 Nov 2026
- Threat actor
- Not attributed. No group named. Huntress and Sophos do not attribute the activity.
- CVE
- CVE-2026-84869
Timeline
- Huntress first sees the activity at about 17:47 UTC; about a third of the 288 hosts are hit in the first ten minutes, all of them within about 90 minutes. [1]
- ConnectWise posts an advisory at 22:45 UTC, according to Huntress, and disables extensions including RMM Plus and Labtech Plus across about 400 partner environments as a precaution. [1]
- Huntress publishes its analysis of SCKit; Sophos X-Ops publishes indicators for the malicious ScreenConnect deployments it observed. [1][2]
- The Record reports ConnectWise's statement: about 400 partner environments had at least one RMM+ extension installed, and "their presence alone does not establish compromise". ConnectWise says attackers deployed more remote-access software, with "potential compromise of technician workstations during interactive connections", and tells on-premises customers to disable the extension themselves. Blackpoint Cyber links the toolkit to CVE-2026-84869, a flaw CISA said in September was being exploited. [4]
- Huntress sees another spike in SCKit detections at 16:12 UTC: 205 hosts across 41 organizations. ConnectWise tells partners to run ScreenConnect 26.6.5 or later, which fixes CVE-2026-84869, according to Huntress. [1]