--- title: "ScreenConnect RMM+ SCKit campaign" description: "Huntress documented rogue ScreenConnect deployments through RMM+ extensions in two November 2026 waves." incident_type: "Vulnerability exploitation" status: "active" last_modified: "2026-11-14" canonical_url: "https://www.ally.security/incidents/screenconnect-rmm-sckit-campaign-2026" markdown_url: "https://www.ally.security/incidents/screenconnect-rmm-sckit-campaign-2026.md" stix_url: "https://www.ally.security/incidents/screenconnect-rmm-sckit-campaign-2026/stix.json" --- # ScreenConnect RMM+ SCKit campaign Huntress documented rogue ScreenConnect deployments through RMM+ extensions in two November 2026 waves. Last modified Nov 14, 2026 · 3 sources ## Summary - **Environment:** Partner ScreenConnect extensions and managed endpoints - **Operational impact:** Unauthorized remote-access clients deployed; full scope unresolved - **Financial impact:** No confirmed incident cost quantified ## What happened [Huntress](https://www.huntress.com/) observed attackers pushing commands through [ScreenConnect](https://www.screenconnect.com/) panels to install rogue remote-access clients and the SCKit toolkit on November 11, 2026. [2](#source-2) ## Impact Huntress counted at least **288 hosts across 48 organizations** in the initial 90-minute wave and **205 hosts across 41 organizations** on November 13. These are separate telemetry populations, not a deduplicated campaign total. [2](#source-2) [ConnectWise](https://www.connectwise.com/) disabled implicated extensions in approximately 400 cloud environments as a precaution. That installation count is not a count of compromises. [3](#source-3) ## Timeline ### November 11, 2026 — Mass endpoint deployment observed Huntress documented the initial wave. [2](#source-2) ### November 13, 2026 — Further wave observed The [updated investigation](https://www.huntress.com/blog/sckit-worm-rogue-screenconnect) described additional deployments. [2](#source-2) ### November 14, 2026 — Briefing updated This briefing was last reviewed and updated on November 14, 2026. ## Threat Group & Attack Vector Huntress linked command activity to an RMM+ default-key authentication defect. It had not observed the toolkit’s attempted endpoint-to-technician spread succeed in recovered logs. [2](#source-2) The [CVE-2026-127063 advisory](https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-127063) identifies the independent extension’s default-secret issue; no patched extension was announced. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1219 — Remote Access Software](https://attack.mitre.org/techniques/T1219/): attackers deployed unauthorized remote-access clients. [2](#source-2) ## Response ConnectWise’s [guidance](https://www.connectwise.com/company/trust/advisories) calls for disabling implicated extensions on premises and verifying technician clients at 26.6.5 or later. Client updates block the attempted propagation technique but do not remove existing compromise. ConnectWise found no evidence that its infrastructure or a ScreenConnect flaw provided initial access. [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### RMM+ default-credential advisory CVE-2026-127063 official · ConnectWise · Nov 12, 2026 ### SCKit campaign through ScreenConnect extensions research · Huntress · Nov 11, 2026 ### ConnectWise Cloud Backup service interruption advisory official · ConnectWise · Oct 16, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: Huntress linked observed command activity to RMM+ and identified default-key authentication defects in versions 1.0.31 and 1.0.32. It had not observed the toolkit’s attempted endpoint-to-technician propagation succeed in recovered logs. 2. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: Huntress observed unauthorized command execution through ScreenConnect panels deploying rogue remote-access clients and SCKit on November 11. Its telemetry counted at least 288 hosts across 48 organizations in 90 minutes. 3. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: ConnectWise assigned CVE-2026-127063 to the independent RMM+ extension’s default API secret, which could permit unauthorized commands. No patched extension version was announced; disabling it was the mitigation. 4. **Began At · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: 2026-11-11 5. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: On November 13 Huntress observed another wave affecting 205 hosts across 41 organizations. These wave-specific populations are not deduplicated into a campaign-wide total. 6. **Used Attack Technique · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: https://attack.mitre.org/techniques/T1219/ 7. **Occurred At · 100% confidence · current** Mass endpoint deployment observed: 2026-11-11 8. **Exploited Vulnerability · 90% confidence · current** SCKit deployments through partner ScreenConnect environments: CVE-2026-127063 9. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: Mass endpoint deployment observed 10. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: Further SCKit wave and vendor guidance 11. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: ConnectWise urged on-premises partners to disable implicated extensions and all partners to verify technician clients at version 26.6.5 or later, which blocks the attempted propagation technique. These measures do not remove an established compromise. 12. **Disclosed At · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: 2026-11-11 13. **Resulted In · 100% confidence · current** SCKit deployments through partner ScreenConnect environments: ConnectWise disabled implicated extensions in approximately 400 cloud environments as a precaution; that figure is installations, not confirmed compromises. It reported no evidence that its infrastructure or a ScreenConnect flaw provided initial access. 14. **Occurred At · 100% confidence · current** Further SCKit wave and vendor guidance: 2026-11-13