This ScreenConnect incident checklist shows RMM and remote-access owners what to disable, what to hunt, and which sessions to revoke after November 11 activity and ConnectWise’s November 12 update. One support connection can carry SCKit from a managed endpoint onto a technician workstation and toward other panels. SecurityWeek said Huntress reports at least six MSPs and 288 hosts across 48 organizations, all hit within 90 minutes.
Updated November 12, 2026
Key Takeaways
- Huntress reported 288 hosts at 48 organizations hit within 90 minutes.
- Disable five RMM+ family extensions and do not reinstall them.
- Do not open interactive ScreenConnect sessions to suspected hosts.
- Extension removal and password resets may leave endpoint access intact.
What should a ScreenConnect incident checklist cover first?
Start with extension status, not a live session. ConnectWise’s Trust Center advisory, updated November 12 at 02:45 UTC, says it has found no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect itself. Initial access and full scope remain under investigation. The initial assessment suggests the activity may involve abuse of independent third-party extensions.
About 400 partner environments had at least one RMM+ family extension. ConnectWise disabled them where it could act. That count is installations, not confirmed compromises. On-premises partners must disable the extensions immediately and not re-enable or reinstall them pending further guidance:
- Labtech Plus
- RMM Plus
- RMM+
- RMM Plus Password Link
- RMM+ Password Link
SecurityWeek reported that attackers exploited a vulnerability in RMM+. Huntress said versions 1.0.31 and 1.0.32 accepted a blank access key if none was configured. The extension can run commands outside ScreenConnect accounts, roles, and authentication controls. Commands it reviewed reached endpoints within minutes, with no corresponding login, and were linked to RMM+.
Most of those installs were legitimate. ConnectWise says presence alone does not establish compromise.
How do you hunt for rogue clients without spreading SCKit?
Do not open an interactive ScreenConnect session to a suspected device. Use separate security tooling, and include technician workstations that already connected. ConnectWise has no visibility into partner activity after initial access.
- Preserve authentication, extension-installation, administrative, Run Command, and Toolbox records before removing artifacts.
- Review unexpected accounts, permission changes, commands, and unapproved remote-access software.
- Hunt rogue Access clients and named droppers, including on technician machines.
- From a separate trusted device, revoke sessions, reset credentials, enforce MFA, use unique passwords, and remove excess admin access.
- Isolate affected devices, preserve evidence, validate remediation, then restore connectivity.
The Hacker News, citing Blackpoint Cyber, described Run Command use that checked for ScreenConnect, then downloaded sc.msi and sckit-run.bat. That dropper contacts the defanged host ns.mo7sen[.]dev for sckit-decoder.ps1. Do not browse or execute suspected resources.
SilentForceInstall-WithUninstall.ps1 is described as deploying two unauthorized Access clients. RelayTrap targets the next technician connection and browser sessions such as .ASPXAUTH. Some functions appeared only in payload analysis. Blackpoint found no technical link between the five extensions and SCKit.
How should you lock down technician access?
Review whether RMMPlus.AccessKey was configured. Blackpoint said software pushed through existing agents could run as NT AUTHORITYSYSTEM. Disabling extensions and resetting credentials alone may not remove persistence already on endpoints.
Patch clients for CVE-2026-84869, a CVSS 9.9 improper privilege-management and missing-authorization flaw. Blackpoint said a fully patched client blocked the payload, with no evidence of a patch bypass or an unpatched client as the entry point. CISA added the CVE to the KEV Catalog on September 11, 2026, due September 14, 2026 for federal agencies, after earlier XMRig attacks.
Nevan Beal, principal MDR analyst at Blackpoint, told The Hacker News that November 11 is the earliest publicly reported activity and that earlier compromises cannot be ruled out without further investigation. He said, “At this time, initial access appears to be linked to malicious ScreenConnect extensions, although we do not have sufficient evidence to confirm this.”
Blackpoint Cyber said MSPs should investigate the management relationship, not only the endpoint, including rogue Access installs, command history, technician workstations, and browser sessions. Give those sessions the same scrutiny already applied after the SonicWall SAML MFA bypass.
What should partners watch even without RMM+?
ConnectWise asked every partner to watch unusual sign-ins, unfamiliar locations, repeated failures, unexpected MFA prompts, new admin accounts, and unexpected extensions, commands, or Toolbox use. Verify odd support requests and downloads out of band. Confirm endpoint protection is running. Treat surprises as a supplier-compromise lead, not a closed case.
| Source | What it reported |
|---|---|
| Huntress | At least 6 MSPs, 288 hosts, 48 organizations, within 90 minutes; RMM+ 1.0.31 and 1.0.32 blank-key flaw |
| ConnectWise | About 400 environments with the extensions; no evidence of an infrastructure compromise or a ScreenConnect vulnerability |
| Blackpoint Cyber | Patch blocks the CVE-2026-84869 payload; no evidence of successful spread to a technician workstation |
ConnectWise says an absence of indicator matches does not rule out compromise. Extension disablement, patching, and session review close different gaps.
Frequently asked questions
Which ScreenConnect extensions should partners disable?
Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. ConnectWise disabled them in about 400 environments where it could act; on-premises partners must disable them and not reinstall them pending further guidance.
Does an RMM+ install prove compromise?
No. ConnectWise says presence alone does not establish compromise. Huntress said most installs it saw were legitimate, but versions 1.0.31 and 1.0.32 could accept a blank access key if none was set.
Was ScreenConnect itself breached?
ConnectWise says it has found no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect itself. Initial access and full scope remain under investigation.
Does patching CVE-2026-84869 stop SCKit?
Blackpoint Cyber said a fully patched client blocked that exploit payload in testing. Patching does not remove risk from a compromised operator session, and the firm had not seen evidence the patch was bypassed.
