Rogue ScreenConnect Extension SCKit: How a Blank API Key Unlocked 288 Endpoints in 90 Minutes
Executive Summary
Executive Summary In mid-2025, threat actors exploited a rogue third-party extension called RMM+ within ConnectWise ScreenConnect partner environments to deploy malware dubbed SCKit across at least 288 endpoints spanning 48 organizations. The extension bypassed ScreenConnect's native authentication, MFA, and role controls by using a shared access key that defaulted to blank in versions 1.0.31 and 1.0.32, allowing unauthenticated callers to push commands at scale. Within 90 minutes of the campaign's launch, all targeted machines were compromised, with roughly one-third hit in the first 10 minutes. ConnectWise disabled five third-party extensions across approximately 400 partner environments and found no vulnerability in its core platform.
This incident highlights a growing attacker pattern of weaponizing trusted managed service provider toolchains rather than targeting the core platform directly. As MSPs and MSSPs consolidate remote management under single-pane tools like ScreenConnect, insecure third-party extensions become high-value pivot points that can bypass enterprise-grade controls and reach thousands of downstream customers simultaneously.
Why This Matters Now
Why This Matters NowSupply-chain attacks targeting RMM platforms are accelerating in 2025, with state-aligned groups such as Storm-0940 and opportunistic actors both actively exploiting MSP toolchains. Regulatory bodies including CISA and the FTC have issued fresh guidance requiring MSPs to enforce MFA and vet third-party integrations. Organizations that rely on ScreenConnect or similar platforms face immediate risk if unvetted extensions remain installed, making audit and removal of unapproved add-ons an urgent priority.
Attack Path Analysis
Attack Path AnalysisAn attacker exploited a blank default authentication key in the RMM+ third-party ScreenConnect extension to bypass MFA and user account controls, gaining unauthenticated access to cloud-hosted ScreenConnect partner panels. From there, the attacker pushed malicious commands to 288 managed endpoints across 48 organizations within 90 minutes, installing rogue ScreenConnect clients (SCKit) that displaced legitimate software, established attacker-controlled remote access, and attempted session-cookie theft to pivot laterally to additional customer environments.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker exploited a blank default shared access key in RMM+ extension versions 1.0.31 and 1.0.32, which bypassed ScreenConnect's native user accounts, roles, and MFA. This unauthenticated API-level entry point provided direct access to cloud-hosted ScreenConnect partner management panels without valid credentials, effectively constituting a supply-chain compromise via a malicious or vulnerable third-party extension.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesCompromise Software Supply Chain
Valid Accounts
Remote Access Software
Modify Authentication Process
Steal Web Session Cookie
Match Legitimate Name or Location
Create or Modify System Process
Lateral Tool Transfer
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-Factor Authentication for Remote Access
Control ID: Requirement 8.4
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: Section 500.12
DORA (Digital Operational Resilience Act) – Third-Party Extension and Vendor Risk Oversight
Control ID: Article 28 — ICT Third-Party Risk Management
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Least Privilege Access
Control ID: Identity Pillar — Advanced Stage: Continuous Validation
NIS2 Directive – Supply Chain Security and Access Control
Control ID: Article 21 — Cybersecurity Risk Management Measures
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities and Software Installation Controls
Control ID: Annex A 8.6 / 8.19
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Managed service providers using ScreenConnect face critical supply-chain risk; RMM+ extension bypassed MFA, enabling lateral movement across 48 organizations via compromised remote-access infrastructure within 90 minutes.
Computer/Network Security
Security vendors relying on ScreenConnect remote management are exposed to SCKit malware implanting rogue clients, evading detection by reusing legitimate code libraries and undermining zero-trust segmentation controls.
Financial Services
Financial organizations using MSP-managed endpoints face PCI 4.0 and NIST compliance violations as supply-chain attackers exploit blank authentication keys to exfiltrate session cookies and pivot across customer environments.
Health Care / Life Sciences
Healthcare MSP clients risk HIPAA 164.312 violations as SCKit's session-cookie theft and lateral movement capabilities threaten protected health data across 288 compromised endpoints in multi-tenant remote-access environments.
Sources
Sources- Rogue remote-access campaign spread through ScreenConnect add-on, researchers sayhttps://cyberscoop.com/connectwise-screenconnect-sckit-attack/Verified
- ConnectWise Security Advisory: Unauthorized Access to Partner ScreenConnect Environmentshttps://www.connectwise.com/company/trust/security-bulletinsVerified
- Huntress Blog: SCKit and RMM+ ScreenConnect Extension Abusehttps://www.huntress.com/blogVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Microsoft Threat Intelligence: Storm-0940 and ConnectWise Supply Chain Activityhttps://www.microsoft.com/en-us/security/blog/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attacker exploited a vulnerable cloud-hosted management panel to reach 288 endpoints across 48 organizations with minimal friction. Enforcing segmented, identity-aware access boundaries around RMM infrastructure and managed tenant environments would likely have reduced the attacker's reachability and contained the blast radius across the MSP supply chain.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Restricting which workloads and source identities can reach the cloud-hosted ScreenConnect management panel may have reduced the exposed API surface, limiting unauthenticated inbound paths from unrecognized or untrusted origins even when application-layer credentials were absent.
Control: Zero Trust Segmentation
Mitigation: Applying Zero Trust segmentation policies around the partner management plane could reduce the operational scope an unauthenticated or weakly authenticated session may exercise, limiting how broadly attacker-issued commands could propagate across managed tenant workloads.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement could limit how session-cookie replay attempts or lateral commands may traverse between tenant segments, reducing the reachability of attacker-controlled flows attempting to pivot from one customer workload environment to another through shared management infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility across workload traffic flows could surface anomalous outbound connection patterns from managed endpoints toward unrecognized or attacker-controlled remote management infrastructure, reducing dwell time by making the unexpected C2 destinations more likely to be detected and flagged for policy review.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement could reduce the outbound paths available to attacker-issued commands attempting to stage or transmit harvested credentials or session tokens, limiting which external destinations compromised workloads may reach during a credential theft or pre-exfiltration sequence.
Had prior-stage segmentation and egress controls constrained attacker reachability and cross-tenant movement, the residual impact would likely have been scoped to a smaller subset of endpoints rather than 288 machines across 48 organizations, reducing the number of persistent attacker-controlled RMM implants and limiting the ongoing unauthorized access window.
Impact at a Glance
Affected Business Functions
- Managed IT Service Delivery (Remote Endpoint Management)
- Customer Environment Isolation and Access Control
- Security Operations and Incident Response
- Privileged Session and Identity Management
Estimated downtime: 3 days
Estimated loss: N/A
At least 288 managed endpoints across 48 organizations were compromised with attacker-controlled remote access software. Data categories at risk include session cookies enabling lateral movement to additional customer environments, credentials and authentication tokens accessible via rogue RMM clients, sensitive business data on managed endpoints across multiple industries, and potentially any data accessible through the hijacked ScreenConnect sessions. The SCKit malware specifically included session-cookie-harvesting functionality designed to pivot to other customers' systems through the ScreenConnect panel, representing a broad multi-tenant exposure risk. While cookie-replay attacks were reported as unsuccessful in recovered logs, the full scope of data accessed during the 90-minute window of active compromise remains under investigation.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (microsegmentation and identity-based policy enforcement) to restrict which internal workloads and services can communicate with RMM platforms, ensuring that even if a third-party extension is compromised, blast radius is contained and lateral movement between managed tenants is blocked at the network layer.
- • Deploy Multicloud Visibility & Control to establish behavioral baselines for ScreenConnect panel activity and generate alerts on anomalous command issuance patterns, such as mass endpoint targeting across dozens of organizations within minutes, enabling early detection of supply-chain abuse before full propagation.
- • Enforce Egress Security & Policy Enforcement with FQDN-based outbound filtering to detect and block connections from managed endpoints to unknown or attacker-controlled ScreenConnect relay infrastructure, preventing rogue RMM client beaconing from establishing persistent C2 channels.
- • Leverage East-West Traffic Security controls to monitor and restrict service-to-service communications within partner environments, specifically flagging or blocking session-cookie replay attempts and unauthorized cross-tenant API calls that indicate lateral movement between customer environments.
- • Implement Cloud Native Security Fabric (CNSF) inline enforcement at the control plane level to perform real-time inspection of extension-level API calls within RMM platforms, enforcing that all extension authentication events meet minimum credential and MFA requirements and blocking any authentication attempt using null or blank shared keys before access is granted.
