# ConnectWise ScreenConnect partner-account campaign via third-party extensions (November 2026) CybaVerse threat hunt pack. No CVE, no patch. Severity: **Critical by impact** (our framing, see Caveats). Sources were read on 11 Nov 2026 at 23:05 GMT and the ConnectWise advisory was rechecked when the pack was finished (see "Advisory state at finish"). All times are UTC (the same as GMT in November). - ConnectWise advisory: , entry "ScreenConnect security advisory: Precautionary extension disabling and partner guidance". Published 11 Nov 2026 at 22:45 UTC. Status: "Cause and scope under investigation". - The BleepingComputer report: "Active ScreenConnect attacks breach MSPs, impact dozens of organizations", , published 11 Nov 2026 at 17:56 EST (22:56 UTC). It cites security researchers for the figures and indicators below. ## What ConnectWise says (verified, credited to ConnectWise) - ConnectWise "is aware of reports of unauthorized access to ScreenConnect partner accounts and the deployment of unauthorized remote-access software in customer environments." - It "identified five independent 3rd party extensions that may be associated with this activity", found "approximately 400 partner environments with one or more of these extensions", and "disabled the extensions as a precaution". - Extensions disabled as a precaution: **Labtech Plus**, **RMM Plus**, **RMM+**, **RMM Plus Password Link**, **RMM+ Password Link**. - On-premises: "If you are an on-premise partner with the below extensions, ConnectWise is unable to take action on your behalf. We advise that you take immediate action to disable these extensions." - "The presence of these 3rd party extensions does not, by itself, establish impact." - Disabling them "is a precautionary containment measure. It does not establish that unauthorized software, persistence mechanisms, or access already present on affected devices has been removed." - Under investigation: "The initial access method and full scope have not been established." ConnectWise suspects the threat actor "deployed additional remote-access software through independent 3rd party extensions". Reports "also describe potential compromise of technician workstations during interactive connections to affected devices. These reported behaviors remain subject to validation." - "If you have not deployed these independent 3rd party extensions, we have no reason to believe you are impacted by this incident but encourage all partners to be on heightened alert." - "We will update this advisory as information is validated." ## ConnectWise's precautionary actions (credited to ConnectWise) For partners who have enabled the extensions, in ConnectWise's words (lightly shortened): 1. **Verify extension status.** Confirm the extensions are disabled. Preserve related installation records and activity logs. Do not re-enable or reinstall them pending further guidance. 2. **Investigate suspected compromise through separate security tooling.** Avoid opening interactive ScreenConnect sessions to suspected compromised devices; use your security provider's response tools or another trusted method. 3. **Secure administrative access from a trusted device.** Revoke active ScreenConnect and associated identity-provider sessions, reset relevant passwords, and verify that multifactor authentication is enforced. If a technician workstation may be compromised, use a separate, trusted device. 4. **Review and preserve evidence.** Retain authentication, extension installation, administrative, Run Command, and Toolbox records. Investigate unexpected users, permission changes, software deployments, and commands. 5. **Contain and remediate suspected compromise.** Isolate affected devices, including potentially affected technician workstations. Preserve evidence before removing malicious software and validate remediation before restoring connectivity. "Disabling extensions and resetting credentials alone may not remove access already established on endpoints." 6. **Verify software maintenance.** Confirm servers, technician clients, and endpoint agents meet current published security guidance. "Updating software does not replace investigation and remediation of a suspected compromise." ConnectWise also points partners to the ScreenConnect hardening guide () and to the instructions for disabling extensions (). In a statement quoted in the BleepingComputer report, ConnectWise said it is "aware of reports of malicious activity affecting a limited number of ScreenConnect partners" and that partners "should avoid opening interactive ScreenConnect sessions to suspected compromised devices". ## What the BleepingComputer report says (citing security researchers; not confirmed by ConnectWise) - The researchers said the campaign "started around 17:47 UTC today" (11 Nov 2026) "targeting cloud-hosted ScreenConnect instances", and that they were tracking 6 compromised MSPs and "286+ endpoints" across 47 organizations, "and those numbers are climbing". These figures are the report's, not ConnectWise's. - Attackers used ScreenConnect's Run Command to deploy ScreenConnect clients on managed endpoints, giving remote access outside the legitimate MSP's ScreenConnect environment. - The researchers warned of a possible reverse pivot onto a technician's workstation when the technician opens a session to an infected customer device. The report says it is unclear how this works or whether it uses a software flaw. - Their telemetry points to compromised credentials and hijacked MSP support sessions; how attackers got in is not determined. Sequential attacker tags suggest other MSPs may have been compromised earlier, so check Run Command history even without alerts. ### Indicators (the BleepingComputer report, citing security researchers; defanged here) | Type | Indicator | |---|---| | Attacker relay | 185.99.255[.]28 (hostname: screen) | | C2 domains | newnewnew.gotdns[.]org, soxnewwork.homedns[.]org | | Possible additional C2 | cdn007-digitaldownloads[.]com | | Secondary C2 | sc.payproofkit[.]com (155.94.150[.]39, hostname: WIN-FB5CKHMU4E1) | | Stager | hxxps://ns.mo7sen[.]dev/EadF.php?p=4 | | Rogue ScreenConnect client IDs | 2588ef5c15954b10, ed630cc2c873b091 | | Installer pattern | /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N> | | Attacker name | Addmin | | Files | Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe, Run-Lateral-Full.bat | ConnectWise has not published indicators. The KQL, Sigma and checkers use these literally. ## Our advice (OUR ADVICE, CybaVerse) Not ConnectWise guidance. 1. **Do ConnectWise's six steps now.** There is no patch to wait for. 2. **Find every ScreenConnect client that points at an instance that is not yours.** Each client service carries the relay host in h=. A client pointing at someone else's instance is remote access for them. Use Q1, Q1b, Q4 and Q4c, and on Windows run `Check-ScreenConnectExtensions.ps1 --local --expected-host `. 3. **Restrict who can use Run Command and Toolbox.** Remove the permissions from roles that do not need them (ScreenConnect role-based permissions on the Security page) and review queued commands and Toolbox items. The hardening guide lists the Security Toolkit extension, which can delete all queued commands and toolbox items. 4. **List installed extensions on on-premises servers** and disable any of the five (Administration, Extensions, Options, Disable). Record what you find before changing anything. The checker reads names only; it does not change state. 5. **Hunt for the reported indicators** (Q2 to Q2g, Sigma IOC rules) and for the behaviour behind them (Q3 to Q7): shells from ScreenConnect clients, new client services, Toolbox writes, and new users. Treat "Addmin" as a user name to look for in Windows, your identity provider and the ScreenConnect audit log. 6. **Treat technician workstations as possibly exposed** until the reverse pivot is understood: review them with EDR, and rotate credentials from a separate trusted device. 7. **Keep the ScreenConnect audit log and session recordings** (the server's SQLite database and extended auditing) before any cleanup. ## What is in this pack | Path | What | |---|---| | `kql/connectwise-screenconnect-extensions-2026-11-hunting.kql` | 22 hunts: Q1 to Q1e INVENTORY, Q2 to Q2g IOC, Q3 to Q7 OUR PATTERN | | `sigma/*.yml` | 7 rules (4 IOC, 3 OUR PATTERN); Kusto conversions in `sigma/converted/` | | `scripts/check-screenconnect-extensions.sh` | Bash checker for exports or copied folders (Linux, macOS) | | `scripts/Check-ScreenConnectExtensions.ps1` | PowerShell 7 twin, plus `--local` on Windows | | `tests/` | bash tests, Pester tests with parity, fixtures, KQL parse check, `run_all.sh` | ### Hunts INVENTORY: Q1 client services seen running (h=, p=, client ID); Q1b client services from the registry ImagePath (k= and v= masked); Q1c software inventory; Q1d client network destinations; Q1e App_Extensions folders on on-premises servers. IOC (the BleepingComputer report): Q2 network (Defender); Q2b network (CommonSecurityLog); Q2c DNS (DnsEvents); Q2d file names; Q2e process command lines (client IDs, hosts, stager, files, c=Exploited); Q2f client services for the rogue IDs or IOC hosts; Q2g the "Addmin" account. OUR PATTERN: Q3 shells and script hosts from ScreenConnect clients (Run Command); Q3b a ScreenConnect client installing another client with a relay that is not yours; Q4 client services pointing at a relay not in ExpectedHosts; Q4b System event 7045 for new ScreenConnect services (Sentinel); Q4c devices with more than one client ID or a new one; Q5 files written by ScreenConnect clients (Toolbox and transfers); Q6 users created or added to groups from a ScreenConnect process tree; Q6b SecurityEvent 4720, 4728, 4732, 4756; Q6c changes under App_Extensions and App_Data on the server; Q7 activity under the ScreenConnect client on named technician workstations. ### Sigma | Rule | Label | Kusto conversion | |---|---|---| | `proc_creation_win_screenconnect_client_spawns_shell.yml` | OUR PATTERN | all pipelines | | `registry_set_win_screenconnect_client_service_imagepath.yml` | OUR PATTERN | all but azure_monitor (no registry table) | | `win_system_screenconnect_client_service_installed.yml` | OUR PATTERN | no pipeline only (use Q4b) | | `proc_creation_win_screenconnect_campaign_installer_ioc.yml` | IOC | all pipelines | | `file_event_win_screenconnect_campaign_filenames.yml` | IOC | all pipelines | | `net_connection_win_screenconnect_campaign_ips.yml` | IOC | all pipelines | | `dns_query_win_screenconnect_campaign_domains.yml` | IOC | no pipeline only (use Q2c) | The two OUR PATTERN rules with `REPLACE-WITH-YOUR-RELAY-HOST` need your relay host before use. ### Checkers (read-only) ``` bash scripts/check-screenconnect-extensions.sh --extensions-dir --clients \ --expected-host instance-xxxx-relay.screenconnect.com --files-root pwsh -File scripts/Check-ScreenConnectExtensions.ps1 --local --expected-host instance-xxxx-relay.screenconnect.com ``` - `--extensions-dir`: lists each extension folder's Manifest.xml Name (and Author) and flags the five names ConnectWise lists (exact, case-insensitive), with near matches as REVIEW. It does not read whether an extension is enabled; check the Extensions page (disabled extensions sit in the Inactive section). - `--clients`: one line per client service (for example `Name|PathName` from `Get-CimInstance Win32_Service`). Flags the rogue client IDs, IOC hosts and `c=Exploited` tags from the report, and relay hosts not in `--expected-host`. k=, v= and s= are never printed. - `--files-root`: looks for the four reported file names (12 levels, symlinks not followed). - `--local` (PowerShell on Windows only): reads `HKLM:\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (*)` and the default `App_Extensions` folder, read-only. - No network, no writes, nothing executed. Exit: 0 NO FINDINGS, 1 FINDINGS, 5 REVIEW, 3 UNKNOWN, 4 usage or read error. UNVERIFIED: where ScreenConnect stores extensions on disk (`App_Extensions\\Manifest.xml` with a `` element), the client service name `ScreenConnect Client (<16 hex>)`, the ImagePath parameters (h=, p=, k=, s=, c=) and the Run Command script location under `Windows\Temp\ScreenConnect` are as commonly observed on installations. ConnectWise's Extensions page documentation covers the web console (enable, disable, uninstall) but not the on-disk layout. Current on-premises ScreenConnect servers run on Windows (Linux server support appears to have ended; UNVERIFIED), so the bash checker is for exports and copied folders rather than a live Linux server. ## Unverified and context - The reverse pivot onto technician workstations: ConnectWise says "subject to validation"; the report says the method is unclear. - The role of the five extensions: ConnectWise says they "may be associated" and that it "suspect[s]" their use. - `cdn007-digitaldownloads[.]com` is listed only as "possible additional C2". The report's later paragraph refers to "digitaldownloads[.]com" as the listed potential IOC; we use the full name from the indicator list. - BleepingComputer separately found a July 2026 batch file (SSA-2026-STATEMENT-15518787.bat) that checks for client ID ed630cc2c873b091 and contacted amexsafekeyupdate[.]com, with sandbox downloads from cdn007-digitaldownloads[.]com and cyberrexdesign.screenconnect[.]com. The report says it is unclear whether that activity and this campaign are linked. These three items are not in the indicator list and are **not** used as campaign IOCs in this pack. - Hostnames "screen" and "WIN-FB5CKHMU4E1" are as reported; we have not checked them. - The "Exploited" tag: the report gives `&c=Exploited`; the checkers match any c= value starting "exploited". ## Caveats - The KQL in this pack has NOT been run against a live tenant. It parses offline with Kusto.Language against an assumed schema subset. Tune before relying on it. - No CVE and no patch. Do not wait for one. - "Critical by impact" is our framing (remote access to MSP customer estates), not a vendor score. ConnectWise gives no severity rating. Do not call it a CVSS Critical. - Indicators come from one press report citing researchers; ConnectWise has not published IOCs. IPs can be reassigned. - A name match on an extension or file proves nothing by itself; ConnectWise says the extensions' presence does not establish impact. ## Advisory state at finish Rechecked 11 Nov 2026 at 23:25 UTC: the ConnectWise advisory text is unchanged since it was first read at 23:05 GMT. Published 11 Nov 2026 at 22:45 UTC, status "Cause and scope under investigation", no update entries. ConnectWise says it will update the advisory as information is validated; check it again before acting on this pack. The BleepingComputer page could not be refetched at 23:25 UTC (bot check); the indicators above are from the copy read at 23:05 GMT.