ConnectWise has taken decisive action by disabling five third-party extensions in response to unauthorized access incidents affecting its partners. This measure follows reports of rogue activity impacting numerous endpoints across various organizations. The company assures that the ScreenConnect infrastructure and software remain uncompromised.
Investigations and Initial Findings
ConnectWise has identified approximately 400 partner environments using the third-party extensions under scrutiny. However, the presence of these extensions does not automatically imply a breach. The extensions, which offer API capabilities for remote command execution, are protected by a partner-configured passphrase. Despite these security measures, the situation is still being thoroughly investigated to determine the precise method of unauthorized access.
In an advisory, ConnectWise urged partners to disable these extensions and emphasized the importance of maintaining security vigilance. Organizations are encouraged to actively monitor for unusual activities, such as unexpected admin account changes and unauthorized software installations, to prevent further incidents.
Malware Spread and Exploitation
The cybersecurity firm Huntress has been tracking the malicious activity and reports that attackers are exploiting cloud-hosted ScreenConnect panels to deploy unauthorized ScreenConnect clients. This breach has affected at least 288 managed endpoints across 48 organizations, first detected on November 11, 2026. The attackers appear to be using compromised credentials or hijacked operator sessions for initial access.
The attack method resembles a worm, spreading through a two-step process. Initially, attackers use the Run Command feature of a compromised ScreenConnect panel to install a rogue client, creating a persistent backdoor. The malware then moves laterally, infecting technicians’ workstations and leveraging their access to spread further.
Technical Analysis and Recommendations
The rogue clients are equipped with SCKit, a custom malware toolkit enabling persistent remote access and session cookie interception. Delivered via an encrypted payload, the kit contacts a remote server to execute its malicious functions. Additional malware components include Microsoft Defender exclusions and the installation of secondary rogue clients.
Cybersecurity experts have noted that some scripts may have been generated using a large language model, based on detailed comments within the code. As a precaution, IT teams are advised to review Run Command histories and stay vigilant for unauthorized activities. Sophos has also observed similar unauthorized ScreenConnect deployments, underscoring the need for continued monitoring and security enhancements.
ConnectWise and other cybersecurity firms continue to investigate this evolving threat. Organizations using ScreenConnect are urged to follow recommended security measures diligently to safeguard against potential breaches.
