ScreenConnect attacks on managed service providers: ConnectWise disables RMM+ extensions

What happened

At 22:45 UTC on 11 November 2026 ConnectWise published an advisory saying it is investigating reports of unauthorized access to certain partner ScreenConnect environments. Partners are mostly managed service providers (MSPs) that use ScreenConnect to support their customers' machines. The reports describe attackers deploying their own remote-access software in customer environments. They also mention possible compromise of technician workstations during interactive connections to affected devices. ConnectWise notes that these reports are still being validated.

ConnectWise says it has found no evidence of a compromise of its infrastructure or of a vulnerability in ScreenConnect itself. As a precaution it disabled extensions from the RMM+ family. In an update at 02:45 UTC on 12 November it said about 400 partner environments had at least one of them installed. Having an extension installed does not by itself mean the environment was compromised.

How the attack works

The investigation is ongoing and ConnectWise does not yet know the initial access method or the full scope. This is its working theory:

The extensions involved are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. ConnectWise does not develop them; they are independent third-party extensions. According to ConnectWise they provide an API capable of executing remote commands, protected only by a passphrase the partner configures during setup. ConnectWise disabled them in cloud instances wherever it could act, but it cannot do so for on-premises installations.

How to tell if you were compromised

Indicators published by ConnectWise (defanged). ConnectWise stresses they support an investigation but do not establish root cause. It did not publish file hashes.

185.99.255[.]28                     attacker ScreenConnect relay (hostname "screen")
155.94.150[.]39                     secondary C2 (hostname WIN-FB5CKHMU4E1)
ns[.]mo7sen[.]dev                   PowerShell loader delivery
ns[.]mo7sen[.]dev/EadF.php?p=4      payload staging
sc[.]payproofkit[.]com              rogue ScreenConnect deployment and C2
cdn007-digitaldownloads[.]com       rogue ScreenConnect deployment
newnewnew[.]gotdns[.]org            C2
soxnewwork[.]homedns[.]org          C2

Files:    sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, Run-Lateral-Full.bat,
          runnew.cmd, ToolboxRelayUploader.exe
Paths:    C:\ProgramData\RelayTrap\TrapWatch.ps1
          %TEMP%\sckit-*
Task:     scheduled task "TrapWatch" running as SYSTEM (reportedly every 10 seconds)
Registry: Run key value "RelayTrapLiteAlert"
ScreenConnect client IDs: 2588ef5c15954b10, ed630cc2c873b091
ScreenConnect accounts:   Addmin, rmmserver

ConnectWise adds that the legitimate sqlite3.exe was reportedly abused to access session data stored in browsers. Its presence alone is not evidence of compromise.

Our hunting tips:

• In the ScreenConnect audit log, review new sign-ins, new admin accounts, extension installs, and Run Command and Toolbox activity.
• On customer devices, look for ScreenConnect clients that connect to a relay other than yours.
• Paste logs or EDR exports into our IOC extractor to pull out IPs and domains. It runs entirely in your browser.

Inside the SCKit toolkit (added 13 November)

On 11 November 2026 researchers at Huntress and Blackpoint Cyber published detailed analyses of the tooling the attackers dropped on endpoints. Huntress calls it SCKit and counts at least 288 compromised endpoints across 48 organizations among its own customers. Deployment started around 17:47 UTC on 11 November; a third of the hosts were hit in the first ten minutes and all of them within roughly 90 minutes.

Initial access. Huntress ties the activity to the RMM+ extension: versions 1.0.31 and 1.0.32 accept an empty access key if an administrator never set one, bypassing ScreenConnect user accounts, roles and MFA. Commands arrived through Run Command as SYSTEM, with no matching sign-in in the logs. The CVE record CVE-2026-127063, published by ConnectWise as CNA on 12 November, describes a default static API secret affecting all versions of the extension (CVSS 4.0: 9.3). ConnectWise says it is still assessing the researchers' findings.

On each endpoint, according to Huntress, the kit installs a rogue ScreenConnect client from C:\Windows\TEMP\sc.msi, fetches an encrypted package keyed to the machine's UUID, unpacks into C:\ProgramData\RelayTrap, adds Defender exclusions and installs a second rogue client. The TrapWatch task runs every ten seconds, compiles RelayTrap.exe on the host from RelayTrap.cs, stops the legitimate client and takes over its connection.

The "worm" step. When a technician connects to an infected machine, RelayTrap tries to push and run a file (Run-Lateral-Full.bat) on the technician's side. That script is meant to steal the console's .ASPXAUTH session cookie, upload a script to the Shared Toolbox and broadcast it to other endpoints. It relies on the client flaw CVE-2026-84869 (CVSS 9.9), fixed in 26.6.5 on 8 September 2026 and listed in CISA KEV since 11 September 2026. Neither team saw the spread succeed: Blackpoint confirmed in testing that a current client blocks execution, and ConnectWise's update of 12 November, 18:45 UTC, states that clients on 26.6.5 and later block the technique. Huntress also notes that the trap's heavily commented code looks LLM-generated.

Additional indicators from the analyses (SHA-256). Huntress warns that hashes are weak indicators: scripts are rebuilt with different embedded values and RelayTrap.exe is compiled separately on every host.

d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a  TrapWatch.ps1
3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4  RelayTrap.cs
4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b  install.ps1
8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af  ToolboxRelayUploader.exe
94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11  Panel-Lateral-free.ps1
7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec  Panel-Lateral.ps1
81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781  Stage0Loader.ps1
43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95  Run-Lateral-Full.bat
50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61  runnew.cmd
a1937467fd862916f89342cdd61f55c4bc405fb35b6e1379e27cfbfdba77dcdc  SilentForceInstall-WithUninstall.ps1
d85315bd7602b6f5c13dc0eada2c9cba0892c7cd3b1eb7dacb1bffdd536ceb21  ScreenConnect.ClientSetup.msi

Paths:    C:\Windows\TEMP\sc.msi, C:\Windows\Temp\sckit-run.bat
          C:\ProgramData\RelayTrap\trapbins\<client id>\RelayTrap.exe
          %TEMP%\k<32 hex chars>.ps1, %PUBLIC%\RELAY-TRAP-PROOF.txt
Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run – RelayTrapLiteAlert
Other:    Defender exclusions for msiexec.exe and powershell.exe
          ScreenConnect event ID 201 (file transfer and run)

What Microsoft added (14 November update)

On 13 November 2026 Microsoft said it had confirmed the campaign in its own telemetry and published a detailed write-up. It has not named the actor and gives no count of affected organizations. Compared with the earlier analyses, it adds the following:

• Machine-bound encryption. The decoder reads MachineGuid from HKLM\SOFTWARE\Microsoft\Cryptography, combines it with an X-Lab-Half response header to derive a key (PBKDF2-HMAC-SHA256, 4,096 iterations) and AES-256-CBC-decrypts the bundle into %TEMP%\SCKitBundle. A captured bundle cannot be unpacked without the victim machine, which is one more reason hashes have limited value.
• Console session theft. The kit searches Chrome, Edge, Opera and Opera GX profiles for .ASPXAUTH cookies, decrypts them with DPAPI and the Chromium master key, scans the browser network-service process memory and falls back to volume shadow copies for locked databases. With a stolen cookie it uses ToolboxRelayUploader.exe to upload a script to the Shared Toolbox, queues it for execution and then deletes the item.
• Don't trust the kit's own cleanup. The decoder's cleanup mode restarts the dropper unless it is run with -NoReArm, which fits the reinfection Huntress saw after isolation was lifted. Microsoft explicitly advises against using any cleanup script recovered from the kit; use your own approved response tooling instead.

Microsoft Defender Antivirus detection names to search for in your console:

Trojan:Win32/SuspScreenConnectDownload.EA
Trojan:Win32/Tikise.EA!cmd
Trojan:PowerShell/RelayPersist.FC!MTB
Trojan:PowerShell/SCRelayTrap.EC!MTB
Trojan:BAT/Tikise.A-D, Trojan:PowerShell/Tikise.A-F
HackTool:Win32/ToolboxRelayUploader
Trojan:PowerShell/ScreenConnect.SC!MTB, Trojan:PowerShell/ScreenConnect.DC!MTB

Further hashes from Microsoft's analysis (those already listed above are not repeated):

61a672a13f03a9e81f573535ee92b1ed6cb7e848a33a06048865312d4e185ae2  sc.msi
8e6912deed82e80bb6bd66f73509d024b1f78b993515366d8317e69a97cff4f4  staged toolkit ZIP
b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d  LabConfig.ps1
cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956  Lite-Alert.ps1
5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0  Stop-LabTrap.bat
454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a  TRAP-PROOF.bat
Paths:    %TEMP%\SCKitBundle, %TEMP%\SCKit\trapkit\payload
Other:    Defender path exclusions naming Windows\Temp, ConnectWiseControl_, CWInstall_ or RelayTrap

The blog also ships seven Advanced Hunting queries for Defender covering connections to campaign infrastructure, toolkit command lines, RelayTrap registry values and scheduled tasks, Defender exclusion writes and the generated PowerShell loader artifacts.

What to do

1. Disable all five extensions (on-premises: immediately) and do not reinstall them until ConnectWise issues further guidance. The ScreenConnect documentation (Extensions page) shows how.
2. Preserve evidence first: authentication, extension installation, administrative, Run Command and Toolbox records.
3. From a trusted device, revoke active ScreenConnect and identity provider sessions, reset credentials, enforce MFA and review access to extension APIs.
4. Do not open interactive ScreenConnect sessions to suspected devices. Use separate tooling and include technician workstations in the scope.
5. Isolate and remediate affected devices. ConnectWise warns that disabling extensions and resetting credentials alone may not remove unauthorized software, persistence or access. Huntress recommends removing the rogue client service, the TrapWatch task, C:\ProgramData\RelayTrap, the %TEMP% files and the RelayTrapLiteAlert Run value, and it has seen reinfection after isolation was lifted. Do not run the kit's own cleanup script (Microsoft): it can re-arm the dropper. Rebuild any device whose integrity you cannot establish.
6. Check every technician client is on 26.6.5.9742 or later. ConnectWise notes that updating a cloud console does not update technician clients. Where it is not needed, temporarily restrict the Transfer Files permission.
7. Keep servers, technician clients and agents up to date and work through the ScreenConnect security guide.

Timeline

Updates

• 14 November 2026 – added Microsoft's 13 November analysis: .ASPXAUTH cookie theft from browsers, MachineGuid-bound bundle encryption, re-arming by the kit's cleanup script, Defender detection names and more hashes. Microsoft says the initial access method is still under investigation.
• 13 November 2026 – added the SCKit analysis from Huntress and Blackpoint (initial access via RMM+ with an empty key, the RelayTrap component, 288 endpoints in 48 organizations), CVE-2026-127063, the 26.6.5+ client guidance from ConnectWise's 12 November 18:45 UTC update, and hashes.
• 12 November 2026 – first version.