ScreenConnect abuse lets attackers push SCKit malware to hundreds of endpoints, Huntress warns
Hackers are abusing the ScreenConnect remote‑access platform to deploy rogue clients that deliver SCKit malware, targeting at least 288 endpoints across 48 organizations and prompting owner ConnectWise to disable five third‑party extensions.
A malware campaign exploiting the ScreenConnect remote‑access platform has targeted at least 288 endpoints across 48 organizations, according to incident data from security firm Huntress.
Huntress reports that attackers are using ScreenConnect to install rogue client instances which then deliver SCKit malware onto victim systems. ScreenConnect, owned by ConnectWise, is widely used by IT teams for remote support and system management, so unauthorized clients on this platform give intruders a direct foothold inside networks.
Once SCKit is deployed through a malicious ScreenConnect client, attackers can use the access to move within an organization’s infrastructure, steal credentials or prepare for further operations such as data theft or ransomware.
ConnectWise has responded by disabling five third‑party extensions linked to ScreenConnect, an indication that the company sees those add‑ons as part of the attack surface in this campaign. Indicators of compromise and other technical details are being shared through public advisories, including a detailed report from The Hacker News.
The episode highlights the risk that comes with relying on remote‑access tools to administer widely distributed systems. The same software that lets administrators solve problems quickly can become an efficient delivery mechanism for malware if attackers succeed in inserting their own clients or abusing existing ones.
For affected organizations, the immediate priorities are identifying unauthorized ScreenConnect activity, checking endpoints for signs of SCKit, and tightening controls around who can deploy and manage remote‑access sessions.
Key developments to monitor include whether more victims beyond the initial 48 organizations come to light, whether known ransomware or data‑extortion groups are seen using access gained through SCKit, and what further technical or policy changes ConnectWise introduces to reduce the risk of similar abuse.
Sources
- OSINT