Emerging Threat: Campaign Targets ConnectWise ScreenConnect Partner Panels to Compromise MSP Customers

Executive Summary

On November 11th, 2026, ConnectWise disclosed that a threat actor used unauthorized access to ScreenConnect partner environments to deploy rogue remote access software to managed endpoints. ConnectWise's initial assessment is that the activity may involve abuse of third-party extensions, and it disabled five of them across partner environments as a precaution. The cybersecurity company Huntress observed the attackers installing rogue ScreenConnect clients along with an attempted malicious toolkit named SCKit.

Managed service providers (MSPs) use the ScreenConnect remote support platform to administer customer systems, so one compromised partner panel can reach every customer of that partner. SCKit attempts to spread to technicians who connect to an infected endpoint by targeting a ScreenConnect client flaw that ConnectWise patched in September.

Given confirmed attacks against MSPs and earlier exploitation of ScreenConnect in 2026, Beazley Security recommends affected organizations confirm the implicated extensions are disabled, and conduct a thorough threat hunt for any signs of compromise. Impacted extensions can be found in the Mitigations / Workarounds section of this advisory.

Mitigations / Workarounds

ConnectWise has disabled Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link plugins in the partner environments it is able to manage. ConnectWise stresses that having one of these extensions installed does not by itself establish compromise. It is also cautioned that disabling extensions and resetting credentials alone may not remove unauthorized software, persistence mechanisms, or access already established on affected endpoints.

Until ConnectWise completes its investigation, the following steps help to reduce risk and support investigative response.

• 

  Confirm the five extensions below are disabled on every ScreenConnect instance, including on-premises servers. Partners running on-premises, self-hosted ScreenConnect servers must disable these extensions themselves:

    Labtech Plus
    RMM Plus
    RMM+
    RMM Plus Password Link
    RMM+ Password Link

• 

  Isolate all affected endpoints until cleanup is complete. Additional IoCs are available in the Indicators of Compromise section of this advisory.

• 

  Review technician workstations that connected to a suspect endpoint for unapproved remote access software, working from a clean device.

• 

  From a clean device, revoke active ScreenConnect web sessions and rotate credentials within impacted environments.

Patches

ConnectWise states it has found no evidence of a vulnerability in ScreenConnect itself, and at the time of writing it has not released a product patch for the initial access, which remains under investigation.

Indicators of Compromise

ConnectWise and Huntress have confirmed active attacks against ScreenConnect partners. Huntress first detected the activity at about 17:47 UTC on November 11th, 2026, and observed roughly a third of affected hosts in their investigation compromised in the first ten minutes across multiple organizations.

Defenders can conduct threat hunts with the information below:

In ScreenConnect audit logs, check for Run Command and Shared Toolbox executions your team did not initiate, unexpected extension installations, new administrator accounts or permission changes, the participant name "Addmin", and installer URLs matching /Bin/ScreenConnect.ClientSetup.msi with a c=Exploited<N> parameter, and the rogue client and instance IDs listed in the IoCs table below.

Run the following endpoint investigations through EDR live response or other monitoring solution. Do not attempt hunting through a ScreenConnect session at this time on suspected compromised devices:

Look for a silently installed C:\Windows\TEMP\sc.msi, curl.exe downloads from 185.99.255[.]28, sckit-* files in the Windows temporary directory, PowerShell launched with an execution-policy bypass to reach ns.mo7sen[.]dev, the C:\ProgramData\RelayTrap directory, a scheduled task named TrapWatch, a RelayTrapLiteAlert value under

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Also check for unexpected Microsoft Defender exclusions, a second unexpected ScreenConnect client, and a legitimate ScreenConnect client that has been stopped and set to manual start:

schtasks /query /tn TrapWatch /v

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v RelayTrapLiteAlert

dir C:\ProgramData\RelayTrap

dir C:\Windows\Temp\sckit-*

powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath"

File hashes are weak indicators for this campaign as each infected machine receives a payload keyed to that device, and RelayTrap is compiled per host, so hashes will vary between affected hosts.

Beazley Security recommends to prioritize the behavioral and network indicators for hunting.

Huntress and Connectwise may provide additional indicators at the following links as the investigation continues:

• 

  https://www.huntress.com/blog/sckit-worm-rogue-screenconnect

• 

  https://www.connectwise.com/company/trust/advisories

Technical Details

On November 11, 2026, beginning at approximately 17:47 UTC, a threat actor used access to multiple cloud-hosted ConnectWise ScreenConnect panels to deploy rogue ScreenConnect clients and a custom toolkit, SCKit, to managed endpoints. At the time of writing, the initial access vector has not been identified.

ConnectWise reported five third-party extensions that may be associated with the activity: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. ConnectWise disabled these extensions across multiple partner environments as a precaution, and partners running on-premises ScreenConnect servers are advised to disable them manually.

The observed attack chain is as follows:

1. 1.

   Execution via panel: The actor used the ScreenConnect Run Command feature to execute commands as SYSTEM on multiple endpoints at once.

2. 2.

   Rogue client install: The command checked for an existing ScreenConnect client, silently installed an attacker-controlled ScreenConnect MSI from C:\Windows\Temp\sc.msi, and wrote a base64-encoded dropper to C:\Windows\Temp\sckit-run.bat

3. 3.

   Keyed payload retrieval: The dropper downloaded a decoder and requested the SCKit package, passing the host’s Windows UUID in the request. The server returned a per-host key, IV, and salt, so each payload decrypts only on the requesting machine.

4. 4.

   Persistence and defense evasion: SCKit, a 16-file package of PowerShell scripts, batch files, and configuration data, extracted to C:\ProgramData\RelayTrap. It then:

   • 

     added Microsoft Defender exclusions
   • 

     installed a second rogue ScreenConnect client
   • 

     created SRP/AppLocker rules that block execution of files pushed through ScreenConnect temp folders, which impedes remediation over ScreenConnect
   • 

     added the RelayTrapLiteAler Run key
5. 5.

   Relay takeover: A TrapWatch scheduled task runs as SYSTEM every 10 seconds. It compiles a host-specific RelayTrap.exe, stops the legitimate ScreenConnect client, sets that client to manual start, and occupies its connection slot on the legitimate relay so the host appears normal in the console.

Huntress researchers reconstructed additional worm functionality of SCkit through code analysis, however this is an ongoing investigation. As of writing Huntress indicate console takeover has failed in recovered log hosts they've reviewed:

1. 1.

   When a technician connects to an infected host, the trap transfers and executes Run-Lateral-Full.bat on the technician’s workstation after connection.

2. 2.

   The workstation retrieves its own keyed kit. Panel-Lateral.ps1 uses a bundled SQLite binary to read browser cookie stores and steal the ScreenConnect .aspxauth session cookie.

3. 3.

   The stolen cookie is replayed against the panel to enumerate all sessions the technician can access.

4. 4.

   ToolboxRelayUploader.exe authenticates as the technician, uploads a payload to the panel’s Shared Toolbox, and broadcasts a run request to all reachable sessions. This installs the trap as SYSTEM on each one. The Toolbox item is deleted after.

Additional threat hunt information is provided in the Indicators of Compromise section of this advisory.

How Beazley Security is responding

Beazley Security is conducting threat hunts across our MDR environment to detect potential exploitation attempts regarding this campaign against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  ConnectWise: ScreenConnect security advisory: Precautionary extension disabling and partner guidance

• 

  Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints