ScreenConnect architecture and attack surfaces Attack chain overview Mitigation and protection guidance Indicators of compromise and supporting artifacts References Learn More Beginning on November 11, 2026, ConnectWise reported an active campaign of a threat actor gaining unauthorized access to cloud-hosted ConnectWise ScreenConnect instances belonging to managed service providers (MSPs).
SCKit abuses ScreenConnect to deploy remote access and target technician sessions
About this summary. This is a short excerpt from the description that Microsoft Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/
Source attribution: headline and facts are from Microsoft Security (microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
What’s happening What is ARTEX? Mitigation and protection guidance References Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the…
Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
Security researchers at Huntress said an intruder used access to multiple cloud-hosted ScreenConnect panels Wednesday to push commands to groups of managed endpoints…
October 2026: Binance Heist, ConnectWise Breach, and More
The major cyber attacks of October 2026 were some of the year’s most consequential, and many of them started with access their victims already trusted. A cryptocurrency…
Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps
TL;DR: App registrations are an app’s blueprint and hold its credentials in one home tenant. Service principals (what you see under Enterprise applications) are the…
When trust becomes the payload: Inside the threats, etc quarterly report
In the cybersecurity community, we build our defenses on a foundation of trust. We trust an AI coding assistant because it’s on our approved software list or can…
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Attack chain overviewAttack chain Host reconnaissance collection SSH authorization and tunnel identities Protocol Tunneling (T1572): reverse SSH forwarding…