ScreenConnect: commands pushed through Run Command to at least 288 managed endpoints at 48 Huntress customers within 90 minutes on 2026-11-11 installed a rogue second client and the SCKit toolkit; Huntress links the activity to the RMM+ extension, whose versions 1.0.31 and 1.0.32 accepted a blank access key

On 2026-11-11 Huntress observed an operator using access to several cloud-hosted ScreenConnect panels to run commands as SYSTEM on groups of managed endpoints through the Run Command feature, hitting at least 288 hosts at 48 organisations that use Huntress within 90 minutes (Huntress, 2026-11-11). Each host checked for a ScreenConnect client, silently installed an attacker-controlled one, wrote a dropper and fetched SCKit, a 16-file toolkit delivered encrypted whose decryption values the server issues against the requesting machine's UUID (Huntress, 2026-11-11). The kit adds Defender exclusions, installs a second attacker-controlled client, sets the legitimate client to manual start so the attacker's copy replaces it, and runs a per-host executable from a scheduled task (Huntress, 2026-11-11).

Huntress's later update says the activity seems related to RMM+, a third-party extension that bypasses ScreenConnect's user accounts, roles and MFA and authenticates requests with a shared access key: versions 1.0.31 and 1.0.32 accepted a blank key when an administrator had never set one, commands reached endpoints across several instances within minutes with no corresponding login activity and were linked in the logs to RMM+; most RMM+ installations it saw were legitimate (Huntress, 2026-11-11). ConnectWise suspects the actor used independent third-party extensions that partners may have added, and disabled five (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link) in about 400 partner environments; on-premises customers must disable them by hand (BleepingComputer, 2026-11-11); Huntress says ConnectWise had not yet identified an initial access vector or the full scope (Huntress, 2026-11-11). Huntress reconstructs a second stage meant to spread through the connecting technician's panel but saw no successful jump (Huntress, 2026-11-11). Huntress says sequential attacker tags suggest other MSPs were compromised earlier; BleepingComputer found a batch script first uploaded on 2026-07-25 that references one of Huntress's rogue client IDs, its link to this campaign unclear (BleepingComputer, 2026-11-11).