Ethical Hacking News
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients: A Sophisticated Malware Threat
A recent malware attack has targeted at least 288 endpoints across 48 organizations, using a sophisticated technique to infect systems. The attackers have used a two-step process to gain access to multiple systems, making it difficult for companies to detect and respond to the attack. The malware has been identified in several ScreenConnect instances, domains, and artifacts, highlighting the importance of cybersecurity and the need for companies to take proactive steps to protect themselves against such threats.
A new variant of malware, "Rogue Clients," has been identified, targeting ScreenConnect, a widely used remote access tool for IT professionals. The malware has affected at least 288 endpoints across 48 organizations, compromising their security and potentially exposing sensitive data. The malware uses a two-stage approach to infect systems, with the first stage deploying the malware through a compromised ScreenConnect panel and the second stage using lateral movement to spread laterally across infected systems. The malware is designed to use techniques such as relay trapping and base64 encoding to hide its presence and make it more difficult to detect. The attackers have been observed using a technique called "LLMjacking" to generate malware and infect systems. ScreenConnect users are advised to check their Run Command history even if they haven't received alerts. The attack is believed to have started on November 11, 2026, at around 5:47 p.m. UTC, and the attackers are believed to have used compromised credentials or hijacked operator sessions to gain initial access to the infected systems.
The cybersecurity landscape is currently facing a critical threat, as a new variant of malware has been identified, specifically targeting ScreenConnect, a widely used remote access tool for IT professionals. The malware, dubbed "Rogue Clients," has been reported to affect at least 288 endpoints across 48 organizations, compromising the security of these systems and potentially exposing sensitive data.
According to recent reports, the malware was first detected on November 11, 2026, by cybersecurity researchers at Huntress, a company that tracks and analyzes security threats. The malware is believed to have been introduced to the affected systems through a compromised ScreenConnect panel, which was used to deploy the Rogue Client malware. This malware is designed to establish a persistent backdoor on infected systems, allowing attackers to remotely access and control these devices.
The malware is highly sophisticated, using a two-stage approach to infect systems. In the first stage, the malware is deployed through a compromised ScreenConnect panel, which is used to deploy the Rogue Client malware. This malware is designed to create a persistent backdoor on infected systems, allowing attackers to remotely access and control these devices. In the second stage, the malware is used to spread laterally across infected systems, using a technique known as "lateral movement."
Lateral movement involves using a compromised system to spread the malware to other systems within the network. This allows the attackers to gain access to multiple systems, increasing the potential damage. The malware is also designed to use a technique known as "relay trapping," which involves using a compromised system to intercept and steal session cookies from other systems. This allows the attackers to gain access to multiple systems without being detected.
The malware has been identified in several ScreenConnect instances, including those identified by Sophos, a cybersecurity company that tracks and analyzes security threats. The malware has also been observed in several domains, including ns[.]mo7sen[.]dev and sc[.]payproofkit[.]com. These domains are believed to be used by the attackers to communicate with each other and to receive updates on the malware.
The attackers are also using a technique known as "base64 encoding" to hide the malware. This involves encoding the malware in base64 format, which is a way of representing binary data using text characters. The attackers are using this technique to disguise the malware and make it more difficult to detect.
The malware is also designed to use a technique known as "API calls" to communicate with the attackers. This involves using a specific set of APIs to send and receive data between the malware and the attackers. The attackers are using this technique to receive updates on the malware and to send commands to the infected systems.
The threat actor has been observed tagging each compromised managed service provider (MSP) with a sequential number. Huntress said the tags it has observed start partway through the sequence, indicating other MSPs may have been compromised earlier. ScreenConnect users are advised to check their Run Command history even if they haven't received alerts.
In a separate alert, Sophos said it has also observed unauthorized ScreenConnect client deployments following the same modus operandi. The activity has originated from three ScreenConnect instance IDs, d905b2b1b165d0a9, 4b8f4089ddaac6a9, and df1f7ef0cfacd0d8. It's suspected that these are compromised instances that are being used to execute commands and deploy additional malicious instances, whose IDs are below -2588ef5c15954b10, ed630cc2c873b091.
The attack is believed to have started on November 11, 2026, at around 5:47 p.m. UTC. The attackers are believed to have used compromised credentials or hijacked operator sessions to gain initial access to the infected systems. The malware is designed to use a two-step process, where the initial access method and full scope remain under investigation.
ConnectWise, a company that provides IT management software, including ScreenConnect, has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. The company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software.
The overall attack unfolds in a worm-like fashion, using a two-step process - Initial access and Lateral movement. The initial access method and full scope remain under investigation. The list of extensions identified for precautionary disabling is below - Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.
The company has urged on-premises partners to disable the extensions and is recommending all partners to ensure security controls are running, preserve suspicious activity logs, and stay vigilant for unusual sign-ins, unfamiliar locations, repeated login failures, and unexpected multi-factor authentication (MFA) prompts.
The attackers have also been observed using a technique known as "LLMjacking" to infect systems. LLMjacking involves using a large language model (LLM) to generate malware. The attackers have been observed using this technique to generate malware, which is then used to infect systems.
The malware has also been identified in several artifacts, including sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, Panel-Lateral.ps1, Run-Lateral-Full.bat, runnew.cmd, and ToolboxRelayUploader.exe. These artifacts are believed to be used by the attackers to communicate with each other and to receive updates on the malware.
In conclusion, the ScreenConnect malware crisis highlights the importance of cybersecurity and the need for companies to take proactive steps to protect themselves against such threats. The attackers have used a sophisticated technique to infect systems, using a two-step process to gain access to multiple systems. The attackers have also used a technique known as "base64 encoding" to hide the malware, making it more difficult to detect.
The threat actor has been observed tagging each compromised managed service provider (MSP) with a sequential number, indicating that other MSPs may have been compromised earlier. ScreenConnect users are advised to check their Run Command history even if they haven't received alerts.
In a separate alert, Sophos said it has also observed unauthorized ScreenConnect client deployments following the same modus operandi. The activity has originated from three ScreenConnect instance IDs, d905b2b1b165d0a9, 4b8f4089ddaac6a9, and df1f7ef0cfacd0d8. It's suspected that these are compromised instances that are being used to execute commands and deploy additional malicious instances, whose IDs are below -2588ef5c15954b10, ed630cc2c873b091.
The attack is believed to have started on November 11, 2026, at around 5:47 p.m. UTC. The attackers are believed to have used compromised credentials or hijacked operator sessions to gain initial access to the infected systems. The malware is designed to use a two-step process, where the initial access method and full scope remain under investigation.
Related Information:
https://www.ethicalhackingnews.com/articles/ScreenConnect-Malware-Crisis-Understanding-the-Rogue-Clients-and-Lateral-Movement-Tactics-ehn.shtml
https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html
Published: Thu Nov 12 00:25:30 2026 by llama3.2 3B Q4_K_M
