Huntress has identified malicious activity on some hosts that was delivered through ScreenConnect (ConnectWise Control) instance. An unauthorized party used the instance's "Run Command" feature to install a second, attacker-controlled ScreenConnect client and a toolkit on every host it could reach. The toolkit is designed to spread: a technician who connects to an infected host from any ScreenConnect instance can have their own session captured and used against every host in that instance.
Huntress has isolated the affected hosts and sent individual Incident Reports. Until the steps from the sent Incident Reports are complete, do not connect to any affected host with ScreenConnect from any instance, including a new or trial instance.
What we observed
- Starting at approximately 17:48 UTC on 11 November 2026, your ScreenConnect instance issued a Run Command to its sessions. On each host the command downloaded a ScreenConnect client installer from an attacker-controlled server and installed it as a second client, reporting to attacker infrastructure.
- The same command then retrieved a PowerShell toolkit, installed a scheduled task running as SYSTEM, and placed a modified ScreenConnect client that impersonates your legitimate client to your own instance. That component waits for a technician to connect and, when one does, delivers the toolkit to the connecting technician.
- This activity was seen across multiple partners at the same time. It is the same toolkit and the same infrastructure in every case.
What Huntress has done
- Isolated the affected hosts we have detected the activity on. Isolation blocks the attacker's remote access and stops the toolkit from reaching its servers, but it does not remove it.
- Opened incident reports for each affected host with the specific indicators found on it.
- Performed Assisted Remediations as outlined in the sent Incident Reports.
- Continued monitoring for new activity across the wider fleet.
If you are impacted, what you need to do now, in this order
- Do not connect to any affected host with ScreenConnect from any instance. The toolkit targets the connecting technician.
- Lock down the ScreenConnect instance now: reset every user password, revoke all sessions, enforce MFA, remove unknown users, review session groups / extensions / Toolbox.
- Treat every technician workstation that connected to an affected host as compromised until checked.
- Rotate credentials used on or stored on affected hosts — domain admin, service, backup, hypervisor accounts and browser-saved credentials first. Assume domain-level exposure where DCs were hit.
- Reboot affected hosts once Huntress remediations show complete.
- Block at firewall/DNS: 185.99.255.28, 155.94.150.39, newnewnew.gotdns.org, soxnewwork.homedns.org, sc.payproofkit.com, ns.mo7sen.dev.
Indicators
| Type | Value | Role |
|---|---|---|
| IP | 185.99.255.28 | Attacker ScreenConnect server; serves the client installer |
| Domain | newnewnew.gotdns.org | Attacker relay, resolves to the IP above |
| Domain | soxnewwork.homedns.org | Attacker relay, resolves to the IP above |
| Domain | sc.payproofkit.com | Second attacker ScreenConnect server |
| IP | 155.94.150.39 | Second attacker ScreenConnect server |
| Domain | ns.mo7sen.dev | Toolkit download server |
| Client ID | 2588ef5c15954b10 | Attacker ScreenConnect client installed on hosts |
| Client ID | ed630cc2c873b091 | Second attacker ScreenConnect client ID |
| Scheduled task | TrapWatch | Persistence, runs as SYSTEM every 10 seconds |
| Path | C:\ProgramData\RelayTrap\ | Trap component and logs |
| Path | C:\Windows\Temp\sckit-* | Toolkit stager files |
If you have any questions please reach out via email to incidents@huntress.com.