{
  "type": "bundle",
  "id": "bundle--f02b4330-aeb0-50b2-8493-0f08476d1427",
  "objects": [
    {
      "type": "campaign",
      "spec_version": "2.1",
      "id": "campaign--78742d1a-18e0-5289-802b-493a2057d49d",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "cam:7342ed6f-b0e2-43ab-8288-becc8ef5d049",
      "name": "SCKit deployments through partner ScreenConnect environments"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--1fe4f1c2-998a-51f5-8f89-ff362ac16d04",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "brh:ab3beff6-aa40-4f8d-8c3d-9091178f6dae",
      "name": "ScreenConnect RMM+ SCKit campaign"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0de772ed-4d10-5409-827c-1ea8d65f46ba",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:a8007174-59cf-4da4-9a70-a92978081ea2",
      "relationship_type": "exploited-vulnerability",
      "source_ref": "campaign--78742d1a-18e0-5289-802b-493a2057d49d",
      "target_ref": "vulnerability--a471c83f-bff7-5b63-81d9-481ceb7a6caa",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:a75059b0-9d07-49df-9a73-dcbb8e8587da",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4cb8f986-2294-5016-8dcc-0558ad838917",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:c3a42eee-0456-4d7e-a715-2b162490f83a",
      "relationship_type": "resulted-in",
      "source_ref": "campaign--78742d1a-18e0-5289-802b-493a2057d49d",
      "target_ref": "x-ally-event--93f2a8a8-31d4-5189-833c-f4301ae0f010",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:b4f169ae-1436-4f0f-974b-1a01ed97d6c2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f2cf58-783f-50d3-8162-070f085c3144",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:c4fc8e6e-e560-4262-af06-2c092231c3a6",
      "relationship_type": "resulted-in",
      "source_ref": "campaign--78742d1a-18e0-5289-802b-493a2057d49d",
      "target_ref": "x-ally-event--fc0c8417-6fef-5269-8afd-4243e7e0bb74",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:4b403e7c-e3ee-445a-a406-c172b9e15fb4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ]
    },
    {
      "type": "vulnerability",
      "spec_version": "2.1",
      "id": "vulnerability--a471c83f-bff7-5b63-81d9-481ceb7a6caa",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "vul:c621fbb3-3677-47a8-b45d-f26fcd831ee6",
      "name": "CVE-2026-127063"
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0452d8a3-be18-5bd0-8fd3-c0a5a89e9944",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:d92538cf-5bda-4701-b01a-589c9e63d67f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:88cfa5bc-3e93-4666-b037-cb5e225bc2f5",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2059f91978f56a181ab70d692956b73571fce0b1dd5b578bca0000dc77784332"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise disabled implicated extensions in approximately 400 cloud environments as a precaution; that figure is installations, not confirmed compromises. It reported no evidence that its infrastructure or a ScreenConnect flaw provided initial access."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1ab9081f-ec2a-586b-8b79-3fca9e69c9f2",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:f7a7849d-edfe-4222-acb0-809b2d77f851",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:72045852-f632-4211-8895-0a4b869a3f40",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-13"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--31f0f99a-9dc7-5bee-8162-f41cec9958d0",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:26abf6a7-5422-4110-bdd3-bbe059e164e0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-127063",
          "external_id": "cit:e3bb6fcb-b499-448c-9e63-072054bd1203",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:879efac1765a611cb30a9a9d61fc8b73afa00206e52e7878708e50beef8a81d6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise assigned CVE-2026-127063 to the independent RMM+ extension’s default API secret, which could permit unauthorized commands. No patched extension version was announced; disabling it was the mitigation."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4f4afaa2-1b5e-55e3-8810-120294bc3078",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:974b25c6-c4b9-4a90-8f7e-71ce1ea4e91f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:cb1c68bc-7b85-4e4f-af7c-dff1004069fe",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-11"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--674d8a84-d0b2-54eb-84bb-e7c80cd805c5",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:c90572a8-df90-42f5-b4dc-8756d3df3f7d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:5c60ca2a-a08c-4c67-a2fe-24f63c78685b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2059f91978f56a181ab70d692956b73571fce0b1dd5b578bca0000dc77784332"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ConnectWise urged on-premises partners to disable implicated extensions and all partners to verify technician clients at version 26.6.5 or later, which blocks the attempted propagation technique. These measures do not remove an established compromise."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8b2e6376-52c1-5db0-8607-a89f6730d7b3",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:8fa548d2-6c9d-4e00-8c9c-641bc9f5db14",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1219/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--937504a2-65d8-50d0-8e9b-27010c631196",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:0b2a4ea5-9462-47f5-9a6f-17fdb6f053b1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:2887298e-633a-4d3a-a3cf-ee1ac89799f4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress observed unauthorized command execution through ScreenConnect panels deploying rogue remote-access clients and SCKit on November 11. Its telemetry counted at least 288 hosts across 48 organizations in 90 minutes."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a7d7eace-5cad-511d-84c9-b4e9a8f91345",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:066147fc-0556-4b0d-903c-e8576267f4f5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:f6b49da4-2a6b-42ec-84e4-07de992892a2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Huntress linked observed command activity to RMM+ and identified default-key authentication defects in versions 1.0.31 and 1.0.32. It had not observed the toolkit’s attempted endpoint-to-technician propagation succeed in recovered logs."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--aeee0cbe-4132-5d12-82f8-5f33fe7e0e2f",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:4817418e-ab02-4b22-b3b6-40b1bc6b5a60",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:6108c396-c449-44da-8376-c9a67b4b8e6e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-11"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d01e161a-88bf-5009-87d0-68639f3c2768",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:48f9132d-84f7-47da-aee7-030453757ba2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Huntress",
          "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect",
          "external_id": "cit:53e39215-a197-4807-8883-1a42d94cca09",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:048d52734960e3d1c7a103551f4fa5e5d6c510bbda466e16fe545bb2068a6f1c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On November 13 Huntress observed another wave affecting 205 hosts across 41 organizations. These wave-specific populations are not deduplicated into a campaign-wide total."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e036dd88-6f0c-59c6-84f4-2c89b5a1cd81",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "clm:d6fea707-8030-42c4-a465-5d56a39b49dc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "ConnectWise",
          "url": "https://www.connectwise.com/company/trust/advisories",
          "external_id": "cit:95d082c9-9f18-4465-b3f8-ce338d34df64",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2059f91978f56a181ab70d692956b73571fce0b1dd5b578bca0000dc77784332"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-11"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--93f2a8a8-31d4-5189-833c-f4301ae0f010",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "evt:f488b068-e118-4460-a27b-02dc05313abe",
      "name": "Mass endpoint deployment observed"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--fc0c8417-6fef-5269-8afd-4243e7e0bb74",
      "created": "2026-11-14T14:11:09.193674+00:00",
      "modified": "2026-11-14T14:11:09.193674+00:00",
      "x_ally_original_id": "evt:b6ef7969-32cb-4f1b-8896-a820f5c200f2",
      "name": "Further SCKit wave and vendor guidance"
    }
  ]
}