Summary
- Environment: Partner ScreenConnect extensions and managed endpoints
- Operational impact: Unauthorized remote-access clients deployed; full scope unresolved
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.
What happened
Huntress observed attackers pushing commands through ScreenConnect panels to install rogue remote-access clients and the SCKit toolkit on November 11, 2026. [2]
Impact
Huntress counted at least 288 hosts across 48 organizations in the initial 90-minute wave and 205 hosts across 41 organizations on November 13. These are separate telemetry populations, not a deduplicated campaign total. [2]
ConnectWise disabled implicated extensions in approximately 400 cloud environments as a precaution. That installation count is not a count of compromises. [3]
Timeline
Mass endpoint deployment observed
Huntress documented the initial wave.
[2]Further wave observed
The updated investigation described additional deployments.
[2]Briefing updated
This briefing was last reviewed and updated on November 14, 2026.
Threat Group & Attack Vector
Huntress linked command activity to an RMM+ default-key authentication defect. It had not observed the toolkit’s attempted endpoint-to-technician spread succeed in recovered logs. [2] The CVE-2026-127063 advisory identifies the independent extension’s default-secret issue; no patched extension was announced. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1219 — Remote Access Software: attackers deployed unauthorized remote-access clients. [2]
Response
ConnectWise’s guidance calls for disabling implicated extensions on premises and verifying technician clients at 26.6.5 or later. Client updates block the attempted propagation technique but do not remove existing compromise. ConnectWise found no evidence that its infrastructure or a ScreenConnect flaw provided initial access. [3]