Security · High impactFan score 67 · Tier A6 sources

SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The Hacker News · 5h ago

The Brief · written from 6 sources

ConnectWise is investigating an active malware campaign against managed service providers that abuses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices.
Researchers report at least 288 endpoints across 48 organizations affected, and ConnectWise says nearly 50 organizations had intrusions.
ConnectWise disabled five third-party ScreenConnect extensions in partner environments; attackers used a flawed legitimate extension to bypass authentication, per SecurityWeek.

Why it matters

Attackers can reach customer machines through trusted MSP remote-management tooling, and the reported campaign has been linked to ransomware deployment, so MSPs and their customers face a wide blast radius.

Who’s affected

MSPs using ConnectWise ScreenConnect
ScreenConnect customers with third-party extensions installed

What to do

Check ScreenConnect environments for unauthorized rogue remote-access clients
Review installed third-party ScreenConnect extensions and disable any that are not needed or trusted

#screenconnect
#msp
#malware
#supply-chain
#ransomware
#remote-access

The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the…

Read the full story at thehackernews.com ↗