decrypted · 12 november 2026 · vulnerabilities and patching · supply chain · uk policy and law

ScreenConnect abused to reach dozens of firms through their IT providers

Since this morning's bulletin, a different problem has surfaced in the tools IT firms use to run other people's computers. On Wednesday evening the security firm Huntress reported an active campaign against managed service providers (MSPs, the outsourced IT firms many UK businesses rely on), abusing ScreenConnect, a remote monitoring and management (RMM) tool. Huntress counts 6 compromised providers and at least 286 endpoints across 47 organisations, and says the figures are still rising.

A master key cabinet, opened from inside

Think of an MSP as a caretaker holding keys to every client's building, with ScreenConnect as the key cabinet. The attackers did not pick the lock. Huntress says this looks like abuse of legitimate functionality, not a software flaw, and ConnectWise, which makes ScreenConnect, said it has no evidence of a compromise of its own infrastructure or a vulnerability in the product.

What the attackers did was use ScreenConnect's Run Command feature to push rogue ScreenConnect clients onto managed devices. Those clients give them access outside the provider's own environment, so the real provider can no longer see or cut it off. ConnectWise's initial assessment points to five third-party extensions: Labtech Plus, RMM Plus, RMM+ and two Password Link variants. They expose an interface that can run remote commands, guarded by a passphrase the partner sets. ConnectWise disabled them across about 400 partner environments. On-premises customers must do it themselves, and having an extension installed does not mean you were breached.

How the attackers got in is not confirmed. Huntress's telemetry points to stolen credentials or hijacked operator sessions.

What the defender sees

A new ScreenConnect client appearing on a machine where nobody installed one. Huntress named two rogue client IDs, 2588ef5c15954b10 and ed630cc2c873b091. Sequential tags in the attacker's installers suggest earlier victims, so Huntress advises checking Run Command history even if no alert fired.

The worse possibility is unconfirmed: ConnectWise has reports of technician workstations being compromised during interactive sessions with infected devices. That would turn one client's problem into the provider's, and then every other client's. Disabling the extensions is containment only. It does not remove malware or access already established.

The Secure by Design lesson

A tool that can run commands on every client machine should not let third-party code reach that power behind a single shared passphrase. Secure by Design would have extensions off by default, narrowly scoped, approved per action and logged where the customer can see it, with the console itself behind multi-factor authentication (MFA, a second check on top of the password). The cost is friction for technicians, which is why it must be built in.

For a UK director, the useful step is a conversation, not a patch. Ask your provider which extensions its remote tool runs, whether console logins need MFA, and whether it can show you what was run on your machines this month. This is opinion, not advice.

Also this week

Malware networks taken down. Europol said Operation Endgame has struck the Gootloader, CastleRAT and StealC malware networks, securing 6.4 million victim datasets. BleepingComputer reports the UK was among nine countries involved and that 257 domains and 235 servers were seized. These tools are usually the first step before ransomware, so the stolen logins found on the seized servers matter more than the arrests. If staff save passwords in browsers, assume some are in that pile and rotate them. Notification will run through services such as Have I Been Pwned, so it is worth having someone check your domains there today.

A voluntary code for spyware sellers. The Record reports that 14 governments, including the UK and France, which lead the Pall Mall Process, adopted first guidelines for commercial hacking firms on Wednesday. Firms are asked to vet customers, build safeguards against misuse and stop sales when serious misuse is a credible risk. The guidelines are non-binding with no penalties, and fewer than half of the 43 attending countries signed. Critics quoted by The Record note that Britain and France restrict others while championing their own spyware industries. A voluntary code beats none, but the real test is whether export licensing follows. Treat it as a direction of travel, not protection.

A public Windows privilege flaw. BleepingComputer reports that a researcher known as Nightmare Eclipse has published SignDrop, working exploit code that gives SYSTEM-level control on Windows by abusing a Microsoft mitigation for the Common Log File System driver. The report gives no CVE, says there is no patch yet, and says several of the researcher's earlier disclosures remain unpatched. The researcher's claim that it can switch off security tools is unverified, as we could not confirm it with a second source. It is a local privilege flaw, so an attacker needs a foothold first, the kind of access a hijacked remote management tool can provide.

Sources