Security researchers at Huntress say they caught attackers hijacking the remote-support software many small IT providers use to manage their clients' computers. On 11 November, intruders found a shortcut into RMM+, a third-party add-on for ConnectWise ScreenConnect: if the person managing a client's remote-access setup had never configured a password-style access key for the add-on, it would accept a blank one instead of rejecting the request. Attackers used that opening to run commands straight through ScreenConnect's own management console, dropping a 16-script toolkit — nicknamed SCKit — onto every machine they could reach.
What made the attack notable wasn't the entry point so much as the spread. SCKit didn't stop at the first computer; it tried to ride along on IT technicians' own remote sessions to jump sideways into other client networks reachable from the same panel. Huntress says roughly a third of the 288 compromised endpoints, spread across 48 different organisations, were infected within the first 10 minutes, with the whole batch done inside 90. ConnectWise has since disabled several related extensions across close to 400 partner accounts as a precaution, and confirms the underlying ScreenConnect flaw the attackers relied on to get there in the first place was already patched before this wave began.
What this means for your business
If you don't manage your own IT, there's a good chance someone does it for you using exactly this kind of remote-access software — ConnectWise ScreenConnect, or a tool like it from another vendor. This incident is a reminder that your security isn't only about your own passwords and your own staff; it also depends on how carefully your IT provider has configured the tools sitting on your computers. A flaw nobody at your business could see or patch themselves can still reach your machines through the vendor managing them.
This week, ask whoever manages your IT remotely two direct questions: do they use ConnectWise ScreenConnect or a similar remote-support tool, and have they confirmed none of their add-ons were affected by this wave. If a remote-access prompt, an unfamiliar icon, or software you didn't request appears on a work computer, don't click through it — isolate that machine and call your provider before doing anything else. And if your IT support agreement has never said how your provider secures its own management tools, that's a fair question to raise at your next review. Their weak link can become yours overnight.