ScreenConnect hack campaign puts 48 organizations at risk from SCKit malware
Hackers are exploiting remote-access software ScreenConnect to deploy a malicious client that installs SCKit malware, targeting at least 288 endpoints across 48 organizations, according to security firm Huntress. The campaign forces IT teams to question the trust they place in remote management tools that underpin modern business operations.
A fresh cyber campaign abusing the plumbing of corporate IT is forcing hundreds of systems administrators to question what they thought they could trust. Hackers are weaponizing ScreenConnect, a widely used remote-access and management tool, to push rogue clients that install SCKit malware across targeted networks, according to new research from security firm Huntress.
The attackers have already gone beyond isolated probes. Huntress reports that at least 288 endpoints in 48 separate organizations have been targeted so far. Those numbers likely understate the total reach, since they capture only systems the company has visibility into. In each case, the attackers appear to be leveraging ScreenConnect not as a vulnerability in itself, but as a delivery mechanism—abusing its legitimate functionality to gain hands-on control.
SCKit is a malware family designed to give intruders persistent access and flexibility inside compromised environments. Once installed, such tools can be used to steal data, move laterally between systems, deploy ransomware or quietly maintain a foothold for later operations. The use of a remote management client as the installer makes the infection harder to distinguish from normal administrative activity, especially in busy IT environments.
ConnectWise, the company behind ScreenConnect, has responded by disabling five third-party extensions linked to the abuse, according to the same reporting. That step suggests that attackers may be piggybacking on or masquerading as add-ons that extend the platform’s functionality. For legitimate users, the immediate impact is twofold: some workflows tied to those extensions may break, and administrators now need to re-validate which components of their own toolchains they can still trust.
For the people running small and mid-sized business networks, managed service providers and even some larger enterprises, this kind of attack goes straight to operational risk. Remote access tools are how overworked IT teams patch systems, troubleshoot issues and support a growing population of remote workers. If those tools can be turned into attack vectors, every connection and every background client update becomes suspect.
Strategically, the incident underscores a vulnerability in the broader software supply chain. Instead of hammering away at external firewalls, attackers increasingly aim for the management layers that sit deeper inside networks: remote monitoring agents, backup systems, deployment tools. Compromise one of those, and you can reach hundreds or thousands of endpoints in a single move, which explains why such platforms have become prized targets for both criminal and state-linked actors.
For insurers, regulators and boards, the numbers in the Huntress report will feed into a growing debate over how to assess third-party IT risk. A single compromised plugin that can touch dozens of organizations at once changes the calculus for cyber insurance premiums and incident-response planning. It also raises pressure on vendors like ConnectWise to police their own ecosystems aggressively, from code signing practices to extension vetting.
At a practical level, IT teams reading the indicators of compromise (IoCs) published alongside the research will be combing through logs for signs of suspicious ScreenConnect client deployments and unexpected connections. Organizations that have outsourced much of their IT to managed service providers will be asking pointed questions about how those partners are segmenting access and monitoring for misuse.
The clearest signals to watch in the coming days will be whether incident numbers climb as more compromises are discovered, whether any victims report data theft or ransomware deployment tied to SCKit, and whether other remote management platforms report similar abuse. If this campaign turns out to be a template rather than an isolated case, the trusted tools behind everyday IT support may quickly become one of the most dangerous blind spots in corporate security.
Sources
- OSINT