Morocco warns of coordinated cyberattacks targeting ScreenConnect cloud systems

Morocco’s General Directorate for Information Systems Security (DGSSI) issued a cybersecurity alert Thursday warning of a major cyberattack campaign targeting cloud-based ConnectWise ScreenConnect management consoles and managed service providers (MSPs).

The warning follows a security advisory from ConnectWise reporting a coordinated attack against managed service providers using the cloud version of ScreenConnect. Attackers reportedly gained control of the administrative consoles of at least six providers and issued malicious commands to at least 288 computers across 48 organizations within just 90 minutes.

Technical findings link the incident to ConnectWise ScreenConnect environments using third-party extensions from the RMM+ family. The five identified extensions are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link.

As a precaution, ConnectWise disabled the extensions in environments it could access. The company stressed, however, that the presence of these extensions alone does not conclusively indicate that a system has been compromised.

Attackers used legitimate remote-management functions

According to the technical analysis, attackers exploited ScreenConnect’s legitimate “Run Command” function to deploy a second, attacker-controlled client alongside a malicious tool identified as “SCKit.”

The tool can install a malicious client to maintain persistent remote access, replace the legitimate client, and add exclusions to Microsoft Defender. It also uses AppLocker to prevent IT security teams from running remediation tools and commands.

SCKit reportedly establishes persistence through a scheduled task named “TrapWatch” and attempts to steal technicians’ administrative sessions. This could allow attackers to move laterally and spread to other ScreenConnect management consoles operated by different providers.

The reported attacks primarily affected cloud environments running ScreenConnect versions 26.6.6.9747 and 26.7.6.9783.

Researchers suspect a possible link between the campaign and an authentication vulnerability in the RMM+ extension, specifically versions 1.0.31 and 1.0.32. The flaw reportedly occurs when administrators have never configured an access key, allowing the system to accept an empty key.

ConnectWise said its investigation remains ongoing as it works to determine the initial access method and the full scope of the incident.

The company added that it had found no evidence that its own infrastructure had been compromised or that the ScreenConnect software itself contained a vulnerability. As a result, simply updating the software may not be sufficient to remove a potential compromise.

DGSSI issues urgent security recommendations

The DGSSI urged affected organizations and their service providers to take immediate protective measures, including integrating the accompanying indicators of compromise (IOCs) into their detection and security systems.

It also advised organizations to identify and immediately disable all five extensions, including in on-premises deployments, and to keep them disabled until ConnectWise issues further instructions.

Other recommendations include terminating active sessions on management consoles, changing passwords and revoking authentication tokens associated with user accounts and identity providers.

The agency further called on organizations to restrict access to the “Run Command” and “Shared Toolbox” functions to a limited number of administrators and review audit logs for unusual connections or unauthorized client installations.

It advised against using ScreenConnect to access any device suspected of being compromised and recommended centralizing logs through security information and event management (SIEM) systems to trigger alerts when commands are executed across an unusually large number of devices.

The DGSSI also urged organizations to verify that they had applied updates addressing two vulnerabilities covered in its previous security advisories.