Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs

ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA

Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments.

Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the time, its security operations center was tracking six compromised managed service providers (MSPs) and more than 286 affected endpoints, with the numbers still climbing.

ConnectWise acquired popular remote supporttool ScreenConnect in February, 2015.

REG AD

Huntress spotted the attacks at around 1747 UTC, when someone began using ScreenConnect's remote command feature to install rogue clients on machines managed by multiple IT service providers. All 288 endpoints were hit within 90 minutes, with roughly a third compromised in the first ten minutes.

REG AD

Huntress suspects more MSPs may have been compromised, as the attackers appeared to be numbering their victims sequentially, with the numbers suggesting earlier attacks that it hadn't detected.

The attackers deployed a 16-file malware toolkit dubbed SCKit, which installs a separate ScreenConnect client to maintain remote access even if the legitimate connection is shut down. It also contains code designed to spread the infection to IT technicians and potentially other customers under their control.

Huntress has since traced the activity to a possible authentication weakness in RMM+, a third-party extension that lets other management tools issue commands through ScreenConnect without technicians using its console.

Versions 1.0.31 and 1.0.32 of the extension contain a flaw that means installations without a configured access key will accept a blank one. Because RMM+ operates independently of ScreenConnect's normal user accounts and authentication controls, an attacker could potentially execute commands without defeating MFA.

Huntress said the findings matched what its investigators saw during the attacks, with commands reaching machines across several ScreenConnect installations despite no corresponding login activity.

The researchers also confirmed that the attacks affected ScreenConnect versions 26.6.6.9747 and 26.7.6.9783, meaning administrators running the latest releases weren't necessarily safe.

ConnectWise has acknowledged that third-party extensions may have been involved but has stopped short of confirming how the attackers initially gained access.

In a security advisory, the company said it was investigating unauthorized access to certain partner environments and had identified approximately 400 installations containing at least one extension from the RMM+ family.

REG AD

It has disabled five extensions, including RMM+, RMM Plus, and Labtech Plus, wherever it can do so remotely, and urged customers running their own ScreenConnect servers to follow suit.

ConnectWise stressed that the 400 environments were identified because they had the extensions installed, not because they were necessarily compromised.

The company said: "At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself."

There's another nasty trick buried in SCKit. According to Huntress, the malware is designed to turn an infected computer into a trap for the technician sent to investigate it. If the technician connects through ScreenConnect, the toolkit attempts to transfer malware back to their workstation, steal authentication cookies, and use their access to infect other machines.

That could give attackers a route from one compromised customer into others managed by the same IT provider. However, Huntress says it has yet to see that part of the attack succeed.

"We have not observed that method to spread work successfully. The console-takeover attempt failed in every recovered host log we have checked so far," the researchers wrote.

Huntress also suspects that some of the malware's C# code was generated using an LLM, pointing to unusually detailed comments explaining what the code is supposed to do. Apparently, even malware authors appreciate a little help with their homework.

Both Huntress and ConnectWise are urging administrators not to investigate suspected infections by remotely connecting through ScreenConnect, since doing so could put the technician's own machine at risk. 

REG AD

Administrators are being advised to use other security tools to investigate affected machines, look for rogue ScreenConnect clients, and check what commands have been run. Any malware left behind will also need to be removed before the machines are brought back online.

Huntress warned on Reddit that some machines were becoming reinfected within minutes of being taken out of isolation because the malware had not been properly removed. 

Simply disabling the vulnerable extensions won't necessarily undo the damage, either. As ConnectWise warns, "Disabling extensions and resetting credentials alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints."

And with the attackers already able to install their own remote access software, kicking them out could prove considerably harder than closing the door they came through. ®