ScreenConnect RMM+ plugin flaw lets hackers hit 288 PCs

What is the ScreenConnect RMM+ flaw?

Huntress traced the activity to RMM+, an extension that lets other management tools send commands through ScreenConnect without a technician opening its console. Versions 1.0.31 and 1.0.32 contain a flaw: if no access key has been configured, they accept a blank one. Since RMM+ works outside ScreenConnect's normal accounts and authentication, an attacker could run commands without beating MFA. Huntress saw commands arrive with no matching login activity.

The attacks also hit ScreenConnect versions 26.6.6.9747 and 26.7.6.9783, so running the latest release was no guarantee of safety.

The malware is a 16-file toolkit called SCKit. It installs a second ScreenConnect client so the attackers keep access even if the legitimate connection is cut. It also tries to turn the machine into a trap: when a technician connects to investigate, it attempts to send malware to their workstation and steal authentication cookies. Huntress says that part has not worked so far. It also suspects an LLM helped write some of the code, given the unusually detailed comments.

What should administrators do?

ConnectWise says it found about 400 installations with at least one extension from the RMM+ family, and that this does not mean they were compromised. It has disabled five extensions, including RMM+, RMM Plus and Labtech Plus, wherever it can do so remotely, and wants people running their own servers to do the same. The company says it has found no compromise of its own infrastructure and no vulnerability in ScreenConnect itself.

Both companies advise against investigating through ScreenConnect. Use other security tools, look for rogue clients, check which commands were run, and remove leftover malware before machines go back online. Huntress saw some reinfected within minutes of leaving isolation. ConnectWise warns that disabling extensions and resetting credentials alone may not remove software or access already in place.