ConnectWise on Nov. 12 reported that it’s investigating reports of unauthorized access to certain partner ScreenConnect environments.
In it's Nov. 12 advisory, the company said it found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.
However, ConnectWise said its initial assessment suggested the activity may involve a threat actor’s abuse of independent third-party extensions installed in partner environments.
The company said it identified about 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed.
“Their presence alone does not establish compromise,” said the advisory. “These extensions provide an API capable of executing remote commands. Access to that API is protected by a passphrase configured by the partner during setup.”
Michael Jenkins, chief technology officer at ThreatLocker, explained that the danger with this threat is that attackers can turn a legitimate, trusted IT management tool into a vehicle for distributing malware. ScreenConnect lets IT teams remotely manage devices, but if attackers gain unauthorized access to that capability, they can potentially execute malicious commands across connected endpoints.
“The consequences can extend well beyond a single compromised device, putting business operations, sensitive data, and potentially an organization's entire environment at risk,” said Jenkins.
Reporting from Huntress pointed to a possible weakness in how the ScreenConnect RMM+ extension authenticates requests. Jenkins said if an authentication key hasn't been configured, RMM+ reportedly accepts a blank key. Attackers may be able to exploit this by sending a specially crafted HTTP POST request to the ScreenConnect server to gain unauthorized access. From there, they can potentially abuse ScreenConnect's "Run Command" feature to execute commands on connected endpoints and install malicious payloads, including SCKit, which has been reported in connection with this activity.
“While the full scope and precise exploitation path are still being established, the broader security lesson is clear,” said Jenkins. “Trusted software can become a powerful attack tool when its capabilities aren't restricted.”
Jenkins added that this is where zero-trust makes a difference. Just because an application has been approved doesn't mean it should have unrestricted access to an organization's environment. ScreenConnect uses a unique 16-character public key thumbprint to identify the server associated with its remote access agents. Jenkins said organizations can use this identifier to distinguish authorized ScreenConnect deployments from unauthorized ones.
Joe Brinkley, director of offensive security research and community at Cobalt, said remote management platforms sit on top of thousands of trusted relationships, and attackers have learned that one hijacked operator session can be worth more than a hundred compromised endpoints. Patching the underlying flaw matters, but Brinkley said the larger exposure is delegated trust: third-party extensions, long-lived admin sessions, and bulk command features built for efficiency that rarely get tested the way an attacker would actually use them.
“Organizations working with MSPs should ask how their provider would detect a hijacked technician session,” said Brinkley. “MSPs should run offensive testing against their own management plane, including what an attacker could reach from a single compromised console or workstation. Expect more campaigns that treat the responder as the target, because the people and tools trusted to clean up an incident usually hold the broadest access in the environment.”
