AI-generated infographic: connectwise screenconnect extensions disabled after sckit attacks. Its figures are taken from this article. Infographic: Grok.
By news editor
ConnectWise says it has disabled five third-party extensions across about 400 partner environments of ScreenConnect, its remote access software, after reports that attackers used partners' ScreenConnect accounts to install unauthorized remote access software on customer machines. The company says the way the attackers got in is unconfirmed, and it has not said how many partners or end customers were compromised.
The exposure reaches past the partners themselves. Blackpoint Cyber, a security company whose operations center responded to the intrusions, describes them as a campaign against managed service providers (MSPs), firms that administer other companies' computers, where one technician's access can span many customers.
In its Trust Center advisory, ConnectWise says its own systems and software are not the source. The advisory states: "At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself." Its initial assessment is that a threat actor abused independently developed extensions from the RMM+ family, which provide an API capable of executing remote commands. The five it lists are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link.
That 400 figure counts installations, and the advisory is explicit about it: "This represents environments with the extensions installed, not confirmed compromises." The company disabled the extensions wherever it could act. Partners that run ScreenConnect on their own servers have to disable them themselves, because ConnectWise cannot do it for them.
What happened inside those environments is left to the partners to establish. ConnectWise says it has no visibility or telemetry into partner environments after initial access and cannot determine what actions took place there. Its guidance tells partners with the extensions to investigate with separate security tools, avoid interactive ScreenConnect connections to suspected devices, revoke active sessions, reset credentials and preserve logs. The advisory puts no cost on that work.
Most of the public detail on the attack comes from Blackpoint. On November 11, 2026, it says, its security operations center began responding to an influx of unauthorized ScreenConnect deployments that originated from legitimate, cloud-hosted ScreenConnect instances. Attackers used the instances' built-in remote management functions to install additional ScreenConnect clients that connected to infrastructure outside the affected organizations' own management environments. Blackpoint calls the toolkit behind the activity SCKit.
SCKit has a second target, the technician. According to Blackpoint, a component named RelayTrap tries to send a file back through a support session to the technician's own workstation, a technique associated with CVE-2026-84869, a ScreenConnect flaw that ConnectWise fixed in version 26.6.5. Later components try to recover the technician's logged-in ScreenConnect session and use its permissions to send commands to other machines. For an MSP, those machines can belong to other customers.
Nothing Blackpoint observed shows that second stage succeeding. Its operations center saw the unauthorized installations but no successful spread to a technician's machine. When its researchers ran the recovered code against a current ScreenConnect release, the technician-side client neither fetched nor ran the file, and they found no evidence that the patch had been bypassed.
Whether the extensions were the way in is unsettled. Blackpoint reports no technical link between the five extensions and the SCKit components it analyzed, and treats their possible role in the first access as an unresolved question. "At this time, initial access appears to be linked to malicious ScreenConnect extensions, although we do not have sufficient evidence to confirm this," Nevan Beal, principal MDR analyst at Blackpoint, told The Hacker News.
The Hacker News also reports that Huntress, another security company, identified an authentication flaw in versions 1.0.31 and 1.0.32 of RMM+. Where an administrator had not configured an access key, Huntress told the outlet, the extension would accept a blank one, potentially letting commands run outside ScreenConnect's normal authentication controls. ConnectWise's advisory describes access to the extensions' API as protected by a passphrase that the partner configures during setup. None of the three accounts names the attacker.
Both companies warn that cleanup is larger than switching off extensions. ConnectWise says disabling extensions and resetting credentials alone may not remove unauthorized software or access already established on endpoints. Blackpoint's advice to service providers reads: "For MSPs, the practical lesson is to investigate the management relationship, not only the endpoint."
Updates will come through the Trust Center, ConnectWise says, as its investigation continues. The open items are the initial access method, the number of confirmed compromises among the roughly 400 environments, and whether partners running ScreenConnect on their own servers, which ConnectWise cannot change, have disabled the extensions.
Leave a Reply