Rogue ScreenConnect clients breach 47 orgs via MSP panels

Huntress is tracking an active, worm-like campaign that abuses legitimate ConnectWise ScreenConnect access to spread rogue clients across managed service providers and their downstream customers. As of its 11 November 2026 update, Huntress counted 6 compromised MSPs and more than 286 endpoints across 47 organizations, with the numbers "climbing"; The Hacker News put the running total at 288 endpoints across 48 organizations. Crucially, no ScreenConnect vulnerability is involved — Huntress attributes the activity to abuse of legitimate functionality, most likely via compromised credentials or hijacked operator sessions. ConnectWise has published an advisory and is working with Huntress; BleepingComputer corroborates the scope and response.

How it works

The attacker reaches a cloud-hosted ScreenConnect panel and uses its Run Command feature to deploy rogue, attacker-controlled clients to managed endpoints, then moves laterally — including onto technicians' own workstations, which is what gives it worm-like reach. Huntress saw custom tooling, some of it compiled on the victim machine. The Hacker News, citing Huntress, names the toolkit SCKit and a persistence task called TrapWatch, and reports it adds Microsoft Defender exclusions and can intercept session cookies. The attacker tagged each compromised MSP with a sequential number; because the sequence starts partway through, Huntress warns earlier victims likely exist.

Indicators

Huntress-reported indicators, as published by BleepingComputer and The Hacker News:

Relay IP:        185.99.255[.]28
C2 domains:      newnewnew.gotdns[.]org
                 soxnewwork.homedns[.]org
Rogue client IDs: 2588ef5c15954b10
                  ed630cc2c873b091
Observed files:  Panel-Lateral.ps1, Run-Lateral-Full.bat,
                 runnew.cmd, ToolboxRelayUploader.exe
Attacker handle: "Addmin"

Disabling extensions does not remove malware, persistence or access already established — treat flagged endpoints as compromised, not cleaned.

Action checklist

1. Check your Run Command history in ScreenConnect even if you received no alert — Huntress explicitly recommends this, and the sequential victim tagging means quiet compromises are likely.
2. Don't start an interactive session with a suspect endpoint. Investigate with separate security tooling instead; an interactive connect can hand the attacker your operator session.
3. ConnectWise disabled five third-party extensions — Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link — across roughly 400 partner environments. Cloud-hosted instances were handled by ConnectWise; on-premises operators must disable them manually and not re-enable until ConnectWise clears them.
4. Rotate ScreenConnect admin credentials and enforce MFA on the panel. Initial access points at credential or session compromise, so assume the operator login is the breach path.
5. Hunt for the IOCs above, new Defender exclusion paths, unexpected scheduled tasks, new admin accounts and anomalous sign-ins. Preserve logs before remediating.

Context

This is remote-management tooling abused as the intrusion path once again — the MSP-to-customer blast radius is exactly why attackers keep returning to it. We've logged ConnectWise riding a supply-chain compromise tied to Storm-0940, a cloud-backup incident hitting 162 M365 tenants, and a zero-day in BeyondTrust's remote-support product. None of those needed a product bug to do damage, and neither does this one: when the remote-access panel is the crown jewel, credential hygiene and MFA on the operator console are the control that matters, not the next patch.