Security researchers at Huntress reported that an intruder exploited a third-party extension to install malicious remote management software on at least 288 computers across 48 organizations. The attack leveraged the RMM+ extension, which bypassed standard authentication by using a shared access key that defaulted to blank in specific versions. ConnectWise, the maker of ScreenConnect, disabled five extensions across approximately 400 partner environments while investigating the unauthorized access. The malware, named SCKit, replaced legitimate clients with attacker-controlled copies to maintain persistence and attempted to steal session cookies, though those attempts reportedly failed. This incident follows a previous supply-chain attack attributed to the Storm-0940 group and a separate high-severity vulnerability in ScreenConnect.
Read the full story at cyberscoop.com.
