ScreenConnect Hack Campaign Puts 48 Organizations on the Front Line of Remote‑Access Risk
Hackers are abusing ScreenConnect remote‑access tools to push custom SCKit malware, compromising at least 288 endpoints across 48 organizations, according to a leading security firm. The campaign turns a trusted IT lifeline into an attack vector, leaving companies and public bodies exposed through the very software meant to support them.
A fresh wave of cyberattacks is turning one of IT support’s most useful tools into a weapon, leaving dozens of organizations compromised through software they installed to solve problems, not create them.
Security researchers report that hackers have been exploiting ScreenConnect, a widely used remote‑access platform, to install rogue clients that deliver custom SCKit malware. At least 288 endpoints — individual computers or servers — across 48 distinct organizations have been affected so far, according to analysis shared by incident responders. ConnectWise, the company behind ScreenConnect, has reacted by disabling five third‑party extensions linked to the campaign.
Remote‑access tools like ScreenConnect are designed to let IT departments and managed service providers log into machines over the internet to troubleshoot issues, install updates, and manage systems without sending technicians on site. When attackers gain access to that channel, they inherit the same trusted position and can move through a network with far fewer obstacles than if they were trying to break in from scratch.
In the reported campaign, hackers used ScreenConnect to push unauthorized client software onto machines, which then deployed SCKit — a piece of malware tailored for persistent access and control. Full technical details and indicators of compromise have been published by specialist outlets and security firms, giving defenders a checklist of files, processes, and network behaviors to hunt for.
For the 48 organizations involved, the immediate concern is not only what data may have been accessed or exfiltrated, but whether attackers still have live footholds inside their networks. That includes corporate IT environments, public‑sector systems, and potentially smaller businesses that rely heavily on outside providers and may lack in‑house security teams capable of detailed forensic work.
At an operational level, this kind of attack changes the risk calculus for any entity that has standardized on remote‑support tools. It forces CISOs and IT managers to ask hard questions: who has administrative access to these platforms, how are third‑party plug‑ins vetted, and what monitoring is in place to catch misuse of what looks like legitimate remote activity. Disabling suspect extensions, as ConnectWise did, is one part of the response; reviewing identity and access controls is another.
Strategically, the incident is another sign that attackers are increasingly targeting the software supply chain and management layers rather than individual end users. By compromising the tools that control many machines at once, they amplify their reach. This pattern has appeared in earlier high‑profile breaches involving IT management platforms, and it continues to challenge regulators, insurers, and boards trying to quantify cyber risk.
For employees at affected organizations, the impacts can be subtle but serious: password resets, temporary shutdowns of key systems, delays in customer services, and the looming possibility that personal or client data may have been exposed. For customers, trust in online services and digital records hinges on the belief that back‑end tools are secure — exactly what this kind of campaign calls into question.
When the tool that fixes your network becomes the way an attacker owns it, trust and access merge into a single point of failure.
The critical developments to track now are whether the number of victim organizations grows as more logs are examined, how quickly patched or hardened versions of ScreenConnect and its ecosystem are rolled out, and whether regulators or industry groups issue new guidance on remote‑access governance. Those signals will show whether this remains a contained incident or forces a broader rethink of how much power organizations hand to remote management platforms.
Sources
- OSINT