What Happened
Microsoft observed attackers accessing cloud-hosted ScreenConnect instances used by managed service providers beginning November 11, 2026. They installed unauthorized remote-access clients and SCKit on managed endpoints. SCKit persists through registry entries and scheduled tasks, adds Microsoft Defender Antivirus exclusions, seeks browser authentication cookies, and attempts to spread to technicians when they connect to affected endpoints. ConnectWise is investigating a possible server-side entry route involving RMM+ versions 1.0.31 and 1.0.32; that route is not yet confirmed. A fix for CVE-2026-84869 blocks SCKit’s attempted technician-side spread. [1]
Separately, Project Zero announced a move to disclosure a fixed number of days after vendor reporting, whether or not a patch is ready: 90 days now, 60 days from February 2, 2027, and 30 days from January 3, 2028. It cites faster vulnerability discovery and exploitation, including through large language models, as a reason to shorten the patch gap. This is a policy change, not evidence that AI was used in the ScreenConnect incident. [2]
Why It Matters to Businesses
An MSP tool is a high-trust path into many customer environments. In this incident, compromise of a managed endpoint could also expose a technician’s authenticated access and other sessions they are permitted to reach. Securing the MSP console or removing one unauthorized client may not eliminate endpoint persistence or stolen sessions. [1]
Shorter disclosure windows increase the value of response capabilities that do not depend on a patch: isolating access paths, revoking sessions, detecting misuse and applying temporary controls while a vendor investigates. [2]
Kimbodo Engineering Perspective
The useful connection to AI security is architectural, not attribution. AI applications and agents often depend on privileged operators, service identities and third-party administration tools. Their security therefore depends on controlling those access paths as well as testing models and prompts. Project Zero’s policy reinforces the need to design for a period in which a vulnerability is public but a fix may be unavailable. [1][2]
Detection should correlate behavior rather than treat every remote-support action as malicious. Scheduled tasks, antivirus exclusions, new clients and technician connections are more meaningful when compared with approved administrative activity and change records. [1]
How We Would Implement It
- Contain access: Disable the identified extensions, investigate endpoints and technician workstations out of band, revoke exposed sessions, and inventory unauthorized remote-access clients. Verify technician clients run ScreenConnect 26.6.5 or later; updating the cloud console does not automatically update them. [1]
- Hunt across boundaries: Correlate RelayTrap and TrapWatch tasks, Defender exclusion changes, SCKit loader files, suspicious ScreenConnect clients and campaign infrastructure in endpoint and identity telemetry. Check findings against approved support activity. [1]
- Protect AI workloads: Keep agent and application credentials out of technician sessions where possible, scope service identities narrowly, and log privileged changes to deployments, data access and integrations. Revoke and rotate credentials if the supporting administration path is compromised.
- Prepare for disclosure: Maintain an asset-to-vendor inventory, an owner for each critical dependency, and tested controls for restricting access when a fix is not yet available. [2]
Risks, Costs and Security
Out-of-band investigation, client verification and credential revocation interrupt support operations, but incomplete cleanup risks continued access. Use approved removal tools rather than SCKit’s cleanup script, and validate that persistence and unauthorized clients are gone before restoring normal technician access. [1] Broader monitoring adds telemetry and triage costs; scope it to privileged paths and retain the context needed to distinguish an intrusion from legitimate administration.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
