RMM+ flaw enabled malware attacks on 288 computers across 48 organisations

Hackers exploited a suspected flaw in the RMM+ extension for ScreenConnect to install malware on at least 288 computers across 48 organisations. The incident matters because the extension may have allowed attackers to issue remote commands without using ScreenConnect’s normal login controls or bypassing multi-factor authentication.

Huntress says all 288 machines were hit within 90 minutes, with about a third infected in the first ten minutes. The malware toolkit can install a separate ScreenConnect client and is designed to spread to IT technicians and their other customers, although Huntress has not seen that method succeed. ConnectWise disabled five related extensions in environments where it could, identifying about 400 installations with at least one of them; the company said this did not mean those environments were compromised and reported no evidence of a breach of its own infrastructure or a flaw in ScreenConnect itself.