Adversaries Now Wait for the MSP Technician to Connect

A technician opens a remote session to clear a stuck print queue. The cursor moves, the job disappears, and the client goes back to work. Nothing on screen shows the laptop has been waiting for the technician. SCKit, a toolkit Huntress found across at least 288 endpoints this week, is built to steal the arriving ConnectWise ScreenConnect session and turn one repair visit into a route toward every other client the technician can reach.

Remote monitoring and management (RMM) software has been a staple of the eCrime ecosystem for years, and rogue ScreenConnect clients are routine. In 2021, PINCHY SPIDER's REvil ransomware moved through Kaseya VSA to as many as 1,500 businesses sitting behind their managed service providers (MSPs). In 2024, the ScreenConnect authentication bypass CVE-2024-1709 became a mass exploitation event within days of disclosure.

The access path is old. What changed over the past two months is where adversaries enter, whom they target once inside, and how quickly a new exploit chain outruns the last fix.

Three Doors Into ConnectWise

The ConnectWise ecosystem absorbed three campaigns through three different doors in about two months. In September, worm-like activity ended with the company patching CVE-2026-84869, a critical client-side file transfer flaw CISA warned was under exploitation. In October, Microsoft attributed a campaign against ConnectWise Cloud Backup customers to Storm-0940, a China-aligned threat actor.

Storm-0940 took control of the identities of multiple ConnectWise cloud applications. Its ARTEX AI agents then attempted sign-ins to more than 2,250 customer tenants, exploiting the trust those applications already held. In some environments, the agents moved on to Microsoft Graph and directory operations. They changed application credentials for persistence and altered identities, groups, and privileged roles. A separate, earlier password-spray campaign peaked on October 11 at 2,900 failed logons per minute against 327 accounts at eight organizations.

A privileged multi-tenant application compresses reconnaissance, access, and target selection into a single compromise. Storm-0940 reached tenants through identities those organizations had already approved, then pursued persistence inside some of them. The same concentration eCrime threat actors exploit for scale hands an intelligence service a ready-made portfolio of collection targets.

The November intrusion came through neither a ScreenConnect vulnerability nor a ConnectWise-operated service. It came through RMM+, an independent extension letting outside tools automate remote sessions through an API. According to Huntress, RMM+ bypasses ScreenConnect's user accounts, roles, and multifactor authentication. It authenticates requests with one shared access key. Versions 1.0.31 and 1.0.32 accepted a blank key whenever an administrator never set one. On November 12, the weakness received its own identifier, CVE-2026-127063, covering a static default API secret able to send commands to managed agents whenever administrators leave it unchanged. The record states the ScreenConnect server and client are not affected. The extension worked as a parallel administrative plane carrying the product's authority without its security controls. Commands reached endpoints across several ScreenConnect instances within minutes, with no matching log-in activity.

The November reporting describes two different stages of the same intrusion. Huntress ties the initial panel access to RMM+. Blackpoint Cyber ties CVE-2026-84869 to SCKit's attempted movement from an infected endpoint toward a technician, and its testing found the ScreenConnect 26.6.5 client fix blocks the technique. Blackpoint also found no unauthenticated, internet-facing execution path against ScreenConnect servers. ConnectWise has not confirmed an initial access method. Its initial assessment points to abuse of independent third-party extensions, and it disabled five such extensions across approximately 400 partner environments as a precaution.

Technician as the Target

Once inside, the threat actor used the panel's own Run command to install an attacker-controlled ScreenConnect client and SCKit. The Run command executes as SYSTEM. The observed deployment reached 288 hosts across 48 organizations Huntress protects in about 90 minutes, with a third of them affected during the first 10 minutes. Huntress assesses part of the toolkit's code as generated by a large language model.

SCKit turns the technician session into a return path. It waits on an infected endpoint for a technician to connect, steals the technician's .aspxauth session cookie, and replays it against the ScreenConnect panel. With the panel session in hand, it enumerates every reachable session and uploads a payload to the Shared Toolbox. It broadcasts the payload, then deletes the item about 60 seconds later.

Trust in an MSP flows from the technician to the endpoint, and SCKit is built to reverse the current. Huntress has not observed the reversal succeed. Every console takeover attempt in the host logs checked so far failed, and the cookie replay rests on code analysis alone. A working version would need one technician session on one infected machine to reach an entire client base.

SCKit also turns a responder's first instinct into a potential trigger. A technician connecting through ScreenConnect to investigate an infected endpoint can activate the path aimed back at the technician workstation. Huntress tells MSPs not to connect to affected machines through ScreenConnect and to investigate out of band through EDR live response, WinRM, or another command-line tool. Containment depends on response tooling outside the platform under investigation, and an MSP learning this during the intrusion has learned it too late.

N-central After Hotfix 2

N-able N-central shows how quickly the exposure moves. Researcher Sean Bales published a set of flaws he calls Able2Shell on November 9, outside N-able's reporting channels, and N-able released Hotfix 2 on November 10 to close the ones exploitable without authentication. Bales then published 4EverAble2Shell, a separate unauthenticated exploit chain he says gives root on the server and works against Hotfix 2. A companion set Bales calls Agent2Shell reaches SYSTEM on the Windows machines N-central manages, according to the researcher, provided the threat actor knows the appliance ID.

Probing began within hours of the proof-of-concept release. By November 13, Huntback reported 21 N-central servers mining Monero, 19 of them running Hotfix 2. 4EverAble2Shell sits outside the scope of Hotfix 2, so those 19 servers were exposed to a chain the fix never addressed. The observed attack chain pairs CVE-2026-90436, an Apache Axis flaw, with 4EverAble2Shell for root. It then pulls a script named jup.sh with curl.

The chain requires the Legacy API, off by default and not recommended by N-able, to be enabled and reachable from the internet. On November 12, N-able said hosted environments are not vulnerable to the chain. It told on-premises customers to confirm the interface stays disabled and to upgrade agents and probes.

The observed payload is an XMRig miner capped at half the processor cores, which supports an opportunistic eCrime assessment for the activity researchers can see. It does not establish who else used the same access. Mining is noisy and shows up in routine processor monitoring, while a threat actor holding root on an MSP management server for later movement leaves far less public evidence. Root on that server is worth far more than the processor time the miner consumes.

Management Plane Under Pressure

Nothing ties Storm-0940, SCKit, and the N-central exploitation to one another. Storm-0940 is a China-aligned espionage threat actor, the SCKit threat actor has no attribution beyond an attacker participant name of "Addmin," and the N-central miner looks like routine eCrime. A nation state adversary, an unidentified threat actor deploying worm-like tooling, and an opportunist with a cryptominer all reached for MSP tooling within two months, and each found a different way in.

eCrime is already cashing in on MSP access, mostly through the older door. In February, threat actors began exploiting BeyondTrust Bomgar remote support servers. Huntress ties the activity to CVE-2026-1731, an unauthenticated remote code execution flaw patched days earlier, without confirming the root cause. By April, several of those intrusions ended in LockBit ransomware, which Huntress suspects was built from the builder leaked in 2022. The damage traveled through trust. One MSP's high-privilege Bomgar account reached a client domain controller with Domain Admin rights, and 78 businesses had to be isolated. In another, ransomware at a dental software company spread to three of its downstream clients.

The newer doors keep opening without a clear motive behind them. On November 7, MSP Process disclosed a threat actor had accessed storage holding its application secrets and administrator refresh tokens. The vendor's apps administer client Microsoft 365 tenants on behalf of MSPs. Field Effect cites sign-in attempts across 47 client environments. In one, the threat actor added credentials to dozens of applications and re-enabled accounts responders had disabled. Nobody has attributed the intrusion. eCrime threat actors still reach MSP clients through flaws in the core product, while the integration and identity layer is so far being worked by espionage adversaries and unidentified threat actors.

Authority survives longer than the business reason for granting it. Huntress found most RMM+ installations were legitimate, usually added for a project and left in place. The pattern reaches beyond MSPs. In the reported US$133 million theft from Crédit Mutuel Arkéa, the bank's own account points to a service provider platform already authorized to initiate its transfers. The management plane accumulates permissions faster than most organizations remove them, and adversaries are harvesting the residue.

MSPs spent the years after Kaseya hardening RMM consoles, enforcing multifactor authentication, and patching core products. The 2026 campaigns reached past those controls through a backup application's identities, an extension whose access key could stay blank, a legacy API, and a new exploit chain Hotfix 2 was never designed to stop. Every integration and every technician session inherits the reach of the platform behind it.

MSPs need to treat extensions, service principals, APIs, and technician workstations as parts of the management plane. The work starts with inventorying inherited permissions, removing dormant integrations, revoking exposed sessions, and verifying updates on technician clients as well as servers. The next mass compromise of an MSP starts where inherited authority has outlived its owner, its project, or its scrutiny. The threat actor will be using permissions the MSP forgot it had granted. I assess with moderate confidence MSP targeting is broadening beyond RMM products into the identities, integrations, and sessions surrounding them.