Hackers Deploy Malware in Fresh ScreenConnect Campaign

A threat actor exploited a vulnerability in the RMM+ extension for ConnectWise ScreenConnect to bypass authentication and deploy malware. The campaign compromised at least 6 managed service providers (MSPs) and 288 hosts across 48 organizations within 90 minutes. Attackers used the vulnerability to run commands on managed endpoints, deploying rogue ScreenConnect clients and a malware toolkit called SCKit that provides persistent backdoor access and can self-replicate. ConnectWise disabled five RMM+ family extensions as a mitigation measure.

• securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/ (opens in a new tab)

• Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the GlobeMalware2026-11-10
• C3RB3R attacks Synology NAS: how to protect your files | Kaspersky official blogHighVulnerability2026-11-09
• Bring a tent, I've got the coffee: Lessons from it-saMalware2026-11-05
• ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationHighVulnerability2026-11-05
• Want to Rent an Internet Address at the White House?News2026-11-05