Active ScreenConnect attacks breach MSPs, impact dozens of organizations

An active ScreenConnect attack campaign is targeting managed service providers, with Huntress reporting that six MSPs were compromised and BleepingComputer describing breaches that have affected dozens of organizations. Huntress also details a threat it calls SCKit Worm, which installs rogue ScreenConnect clients and session cookie relays across hundreds of endpoints. The reported scale spans both the upstream MSP layer and the downstream organizations and machines reached through those providers.

BleepingComputer frames the trend as active attacks breaching MSPs and impacting dozens of organizations. Huntress provides the most granular account, reporting six compromised MSPs and describing SCKit Worm's use of rogue ScreenConnect clients and session cookie relays across hundreds of endpoints. Sophos coverage focuses on malicious ScreenConnect deployments being observed, while Mezha.net reports Huntress's finding that six MSPs were compromised in the campaign. The shared emphasis is on ScreenConnect infrastructure being used offensively rather than on a single isolated incident.

The context a reader needs is the layered structure of the campaign as described: MSPs sit between the attackers and the organizations they manage, so a compromise at the provider level can extend the reach to many separate customers. The mention of session cookie relays indicates that the activity involves not only installing additional ScreenConnect clients on machines but also relaying session cookies, which coverage presents as part of the worm's behavior. The headline reporting does not yet specify the initial access vector, the specific organizations affected, or the exact number of endpoints reached beyond the reference to hundreds.

Several developments are worth watching, based on the stated facts. The first is whether the count of compromised MSPs reported by Huntress changes as further coverage emerges. The second is whether additional security vendors document malicious ScreenConnect deployments or the SCKit Worm behavior described by Huntress. The third is the downstream impact on the dozens of organizations BleepingComputer says have been affected, and whether the deployment of rogue clients and session cookie relays continues across endpoints. Coverage does not yet specify remediation steps, affected sectors, or whether the campaign has been contained.