ConnectWise ScreenConnect MSP attacks: 5 extensions disabled

TL;DR: Huntress says an unauthorized party used a ScreenConnect (ConnectWise Control) instance’s Run Command feature to install a second, attacker-controlled ScreenConnect client and a toolkit on every host it could reach, starting at approximately 17:48 UTC on November 11, 2026 (November 12, 1:48 a.m. Manila). Huntress says this activity was seen across multiple partners at the same time, with the same toolkit and the same infrastructure in every case. ConnectWise is investigating reports of unauthorized access to ScreenConnect partner accounts and the deployment of unauthorized remote-access software in customer environments. As a precaution, it disabled five independent third-party extensions — Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link — in approximately 400 partner environments that had one or more of them. On-premise partners must disable those extensions themselves. ConnectWise’s November 11, 2026, 22:45 UTC advisory lists no CVE and no software patch. Check Run Command and session logs, look for unknown clients, and confirm the extension list.

What happened

Huntress, in a support article dated November 11, 2026, 22:23 (the page does not state a timezone), says it identified malicious activity delivered through a ScreenConnect instance. An unauthorized party used the instance’s Run Command feature to install a second, attacker-controlled ScreenConnect client and a toolkit on every host it could reach. The toolkit, Huntress says, is designed to spread: a technician who connects to an infected host from any ScreenConnect instance can have their own session captured and used against every host in that instance.

Starting at approximately 17:48 UTC on November 11, 2026, Huntress says, a ScreenConnect instance issued a Run Command to its sessions. On each host, the command downloaded a ScreenConnect client installer from an attacker-controlled server and installed it as a second client reporting to attacker infrastructure. The same command then retrieved a PowerShell toolkit, installed a scheduled task running as SYSTEM, and placed a modified ScreenConnect client that impersonates the legitimate client. That component waits for a technician to connect and, when one does, delivers the toolkit to the connecting technician. Huntress has not determined how the unauthorized party gained access to the instance.

ConnectWise published a November 11, 2026 ScreenConnect security advisory at 22:45 UTC (November 12, 6:45 a.m. Manila), with the status “Cause and scope under investigation.” It says it is aware of reports of unauthorized access to ScreenConnect partner accounts and the deployment of unauthorized remote-access software in customer environments. As part of its investigation, it identified five independent third-party extensions that may be associated with this activity, found them in approximately 400 partner environments, and disabled them as a precaution. Those extensions, using the advisory’s names, are:

• Labtech Plus
• RMM Plus
• RMM+
• RMM Plus Password Link
• RMM+ Password Link

ConnectWise is explicit that the presence of these extensions does not, by itself, establish impact, and that disabling them is a precautionary containment measure that does not remove unauthorized software or access already present on devices. It also says the initial access method and full scope have not been established. Its initial assessment “leads us to suspect the threat actor deployed additional remote-access software through independent 3rd party extensions,” and it notes reports of potential compromise of technician workstations during interactive connections to affected devices, adding that “these reported behaviors remain subject to validation.”

This is a separate incident from the October 2026 ConnectWise Cloud Backup (formerly SkyKick) service interruption and from Microsoft’s later report on Storm-0940 and ARTEX. Those stories concerned unauthorized access to Cloud Backup application identities, not this ScreenConnect campaign.

Who is exposed

The advisory does not limit the issue to hosted or cloud instances. ConnectWise disabled the five extensions in partner environments it could reach. If you are an on-premise partner with those extensions, ConnectWise says it is unable to take action on your behalf and advises immediate action to disable them. Partners should verify that the extensions are disabled and should not re-enable or reinstall them pending further guidance.

ConnectWise also writes: “If you have not deployed these independent 3rd party extensions, we have no reason to believe you are impacted by this incident but encourage all partners to be on heightened alert.” That is not a clean bill of health. Huntress’s observed activity is the abuse of ScreenConnect’s own Run Command feature after unauthorized account access, and both Huntress and ConnectWise say the initial access method has not been established. Stay on heightened alert and still review Run Command history, session logs, unknown clients, and the extension list.

As of our check, the November 11 advisory lists no CVE and no software patch. Confirming that servers, technician clients, and endpoint agents meet current published security guidance is still useful, but ConnectWise says updating software does not replace investigation and remediation of a suspected compromise. Do not confuse this campaign with the earlier September 2026 ScreenConnect issue; the November 11 advisory does not name a CVE or a version update as the fix.

What to do

1. Confirm the extension list. Verify that Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link are disabled. If any remain enabled, disable them. Do not re-enable or reinstall them pending further guidance. On-premise partners must do this themselves.
2. Review Run Command and session logs, and preserve evidence. Retain authentication, extension installation, administrative, Run Command, and Toolbox records, as ConnectWise asks. Investigate unexpected users, permission changes, software deployments, and commands.
3. Look for unknown ScreenConnect clients and users. Huntress lists attacker ScreenConnect client IDs 2588ef5c15954b10 and ed630cc2c873b091, a scheduled task named TrapWatch that runs as SYSTEM every 10 seconds, the path C:\ProgramData\RelayTrap\, and toolkit stager files under C:\Windows\Temp\sckit-*.
4. Lock down administrative access from a trusted device. Revoke active ScreenConnect and associated identity-provider sessions, reset relevant passwords, verify that multifactor authentication is enforced, and remove unknown users. If a technician workstation may be compromised, ConnectWise says to use a separate, trusted device for these actions.
5. Do not open interactive ScreenConnect sessions to suspected devices. Huntress says not to connect to any affected host with ScreenConnect from any instance, including a new or trial instance, because the toolkit targets the connecting technician. Investigate with separate security tooling. Treat technician workstations that connected to a suspected affected host as compromised until they have been checked.
6. Block the infrastructure Huntress published, where you can: IPs 185.99.255.28 and 155.94.150.39, and domains newnewnew.gotdns.org, soxnewwork.homedns.org, sc.payproofkit.com, and ns.mo7sen.dev.

Disabling the extensions and resetting credentials alone may not remove access already established on endpoints. Contain and remediate through your incident-response process, and preserve evidence before removing malicious software.

Other alerts are on our security coverage hub.

Updates

• Nov 12, 2026, 8:21 a.m. Manila (UTC+8): Initial report covering ConnectWise’s November 11, 2026, 22:45 UTC ScreenConnect advisory and Huntress’s November 11 write-up on Run Command abuse and the spreading toolkit. No CVE or software patch is listed in that advisory as of this check.

Sources & method

• ConnectWise, November 11, 2026 ScreenConnect security advisory: Precautionary extension disabling and partner guidance (published 11/11/2026 at 22:45 UTC) — https://www.connectwise.com/company/trust/advisories
• Huntress, 2026 - November - ScreenConnect (dated November 11, 2026, 22:23) — https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect

Last checked: Nov 12, 2026, 8:21 a.m. Manila (UTC+8). Method: We read ConnectWise’s Trust Center advisory, published November 11, 2026, at 22:45 UTC, at 8:17 a.m. Manila (UTC+8). We read Huntress’s public support article at 8:21 a.m. Manila (UTC+8); a direct request for that URL from our box received a Cloudflare challenge, so we used a fetch that returned the full public article through the [email protected] contact line. The November 11 advisory lists no CVE and no software patch. ConnectWise’s figure of approximately 400 partner environments is the number in which it found one or more of the five named extensions, not a confirmed compromise count. We did not use victim counts that appear only in secondary reporting, because we could not open a Huntress page or official Huntress post that states them. Thumbnail is a reuse-licensed image, credited with its license under the picture. No affiliate links. How we work.