From Silicon Valley, where remote management tools are part of everyday life for tech companies, the alert issued by Morocco’s Directorate General of Information Systems Security (DGSSI) on November 12, 2026, rated “critical” for both risk and impact (reference 71001211/26), caught my attention for a simple reason: once again, it shows how a breach at a service provider can contaminate dozens of organizations within minutes.
A coordinated campaign took control of the administration consoles of at least six managed service providers (MSPs) using the cloud edition of ConnectWise ScreenConnect. In just 90 minutes, commands were sent to at least 288 computers across 48 organizations worldwide, according to information relayed by the DGSSI and observations from researchers such as Huntress. This is not a spectacular flaw in the software itself, but a hijacking of legitimate tools that raises a much broader structural problem for the digital economy.
A warning for businesses
MSPs, the providers to which many companies entrust the management of their IT infrastructure, have become concentration points for risk. By outsourcing maintenance, companies gain efficiency and cut internal costs, but they also grant extensive access to partners. A single compromised console can then serve as a springboard to multiple clients.
ConnectWise ScreenConnect is one of the most widely used tools in this ecosystem for remote access: it allows technicians to reach machines, run commands and carry out maintenance operations without traveling on site. These features, essential in day-to-day work, become dangerous when hijacked. The DGSSI highlights precisely this mechanism: an intrusion initially limited to one provider can spread rapidly across its clients’ networks.
The economic stakes are immediate. A compromise can lead to access to confidential data, the installation of additional malware, business interruptions or the preparation of ransomware attacks. Strategically, it calls into question trust in the IT supply chain, a sensitive issue for companies of all sizes, from small businesses to large groups that outsource their IT. In Morocco, the DGSSI alert (the agency is attached to the National Defense Administration) also shows national vigilance in the face of an international threat.
How the campaign unfolded and the role of SCKit
According to data consolidated by the DGSSI and analyses from Huntress, the attackers hijacked ScreenConnect’s legitimate “Run Command” feature to install a second remote connection client under their control, along with a malicious tool called SCKit. The latter is designed to maintain a persistent presence: it can install an unauthorized client, modify Microsoft Defender settings to weaken protections, use Windows features (such as AppLocker) to block certain remediation tools used by administrators, and create a scheduled task named “TrapWatch”.
SCKit also includes mechanisms aimed at harvesting technicians’ administration sessions, with the potential goal of spreading to other ScreenConnect consoles. Some of these propagation capabilities were observed in the code, even though not all of them have been systematically seen in action in the documented incidents. The ScreenConnect versions mainly affected are 26.6.6.9747 and 26.7.6.9783, both recent builds.
One lead under examination concerns an authentication weakness in certain versions (1.0.31 and 1.0.32) of the third-party RMM+ extension. When the administrator has never configured an access key, the system may accept an empty key, thereby bypassing ScreenConnect’s usual authentication mechanisms (accounts, roles and MFA). This weakness is a lead, but the initial entry point has not yet been formally established. ConnectWise states that nothing at this stage suggests a compromise of its own infrastructure or the exploitation of a vulnerability in ScreenConnect itself. The vendor preventively disabled several extensions from the RMM+ family (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link) in roughly 400 environments to which it had access, while reminding that their mere presence does not prove a compromise.
Key figures of the campaign
- At least six MSPs whose administration consoles were compromised.
- At least 288 computers affected across 48 organizations.
- Commands spread within 90 minutes (with a significant share in the first few minutes, according to Huntress’s observations).
- Around 400 environments where ConnectWise disabled extensions as a precaution.
Recommendations and the limits of patches
The DGSSI urges organizations and their providers to immediately check for the presence of these extensions and disable them, including on on-premises installations, and not to re-enable them until further instructions from the vendor. It recommends revoking active administration sessions, renewing passwords and tokens, restricting permissions on “Run Command” and “Shared Toolbox”, reviewing logs for unusual connections, unauthorized installations or the creation of administrator accounts, and not using ScreenConnect to investigate suspicious machines. Companies should ask their providers which RMM tools they use and which accounts hold privileged access.
A key point stressed by the authority: simply updating the software does not guarantee that a possible compromise has been eliminated. Persistence mechanisms may have been installed. ConnectWise, for its part, is continuing its investigations and encouraging partners to secure their environments.
Final thoughts
This campaign recalls a familiar pattern in the industry: remote monitoring and management (RMM) and remote access tools, prized for their productivity, concentrate supply chain risks. Earlier incidents (such as those involving other remote management solutions) have already shown that compromising an MSP makes it possible to reach many clients at once. Here, the speed (90 minutes for hundreds of machines) and the sophistication of SCKit (persistence, defense evasion, attempted propagation through technicians) heighten the urgency.
From ConnectWise’s perspective, the incident appears to stem from the abuse of third-party extensions rather than a flaw in its core product. Researchers, meanwhile, point to the authentication weakness in RMM+ and the design of SCKit. By rating the alert as critical, the DGSSI insists on the need for an immediate response and on the fact that a company’s system security also depends on that of its partners.
For businesses, the stakes go beyond the technical: it means revisiting contracts with providers, access controls, segmentation and monitoring of RMM activity. An intrusion at a partner can expose systems without any direct failure of their own protections. On a macro scale, it raises questions about the resilience of digital supply chains and the shared responsibility between vendors, providers and clients.
The investigation continues. The exact initial vector and the full extent of the campaign remain under investigation. In a context where remote access tools are everywhere, this alert calls for heightened vigilance, well beyond simple updates.
FAQ
Does the DGSSI confirm a compromise of ConnectWise’s infrastructure?
No. The authority relays ConnectWise’s statements that nothing at this stage suggests a compromise of its infrastructure or a vulnerability in ScreenConnect itself. The initial entry point is still under investigation.
Is simply updating ScreenConnect enough to secure systems?
No. The DGSSI stresses that the attackers may have installed persistence mechanisms. A thorough check (disabling extensions, revoking sessions, analyzing logs) is necessary.
Which organizations are most affected?
Those that use, or whose providers use, the cloud edition of ScreenConnect with extensions from the RMM+ family (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link). On-premises installations should also be checked.
What are the concrete risks for a company that is an MSP’s client?
Unauthorized access to systems, installation of malware, disruption of operations or preparation of more destructive attacks. These risks are potential and depend on the extent of the compromise at the provider.
