Hackers are abusing third-party ScreenConnect extensions to compromise endpoints. ConnectWise on Wednesday said the extensions were installed in 400 partner environments, but added that their presence alone did not establish compromise.
Security firm Huntress spotted the malicious activity on Wednesday after an operator used run commands on cloud-hosted ScreenConnect panels to push malicious scripts to managed endpoints. ConnectWise ScreenConnect is a remote access and support application used by IT administrators.
“The commands installed attacker-controlled ScreenConnect clients and an additional toolkit called SCKit. At least 288 hosts across 48 organizations that use Huntress have been affected,” Huntress said. The campaign targeted ScreenConnect remote monitoring and management software versions 26.6.6.9747 and 26.7.6.9783.
Analysis by the security firm uncovered that the activity stemmed from the RMM+ extension, one of five extensions disabled by ConnectWise. Others include Labtech Plus, RMM Plus, RMM Plus Password Link, and RMM+ Password Link that came with an application program interface for executing remote commands.
“We identified approximately 400 partner environments with one or more of these extensions, and we disabled the extensions as a precaution,” ConnectWise said on Wednesday.
Neither ConnectWise nor Huntress has disclosed details regarding the attackers.
Infection Chain
RMM+ is a ScreenConnect third-party extension that lets another tool manage ScreenConnect sessions without a console. While most RMM+ extensions are legitimate, Huntress says versions 1.0.31 and 1.0.32 contained a serious authentication flaw.
This allowed the attackers to bypass ScreenConnect’s user accounts, MFA, and authenticate requests using a shared access key stored in the extension’s settings, which in those versions defaulted to blank.
ConnectWise added that hackers may have installed additional remote-access software through independent third-party extensions.
SCKit is designed to spread from an infected endpoint to a technician’s workstation that connects to it, and on to other systems connected to the workstation, though Huntress said it has not seen that spread succeed.
To prevent a potential infection, ConnectWise recommends that ScreenConnect users disable the five extensions, revoke active ScreenConnect and associated identity-provider sessions, isolate affected devices, and update their systems.
