What's Happening?
Huntress, a cybersecurity firm, has identified a campaign where attackers are creating unauthorized guest sessions on over 100 self-hosted ScreenConnect servers, disguising them with names related to cryptocurrency exchanges. As of November 13, 2026,
Huntress found 2,408 unauthorized sessions across 118 servers belonging to 109 organizations, with the first session appearing on November 3. These sessions, named like 'KUCOIN-SRV' or 'SRV-BINANCE,' appear as always-online computers in the ScreenConnect console, often with thumbnails resembling trading desktops. The attackers are using a scripted emulator to impersonate Windows ScreenConnect clients, with most connections originating from a single IONOS-hosted IP address. While no malicious activity has been directly observed from these sessions, Huntress hypothesizes they could be bait to exploit client-side vulnerabilities, such as CVE-2026-84869, if a technician connects to them.
Why It's Important?
This campaign poses a significant risk to Managed Service Providers (MSPs) and their clients, as it leverages a trusted remote desktop software to potentially gain unauthorized access or exploit vulnerabilities. The use of crypto exchange names is a clever social engineering tactic designed to entice technicians to connect to these seemingly legitimate, yet unauthorized, sessions. If a technician connects to an unpatched client, it could lead to the execution of malicious files on their workstation, which is often the most privileged machine within an MSP's network. This could result in widespread compromise across multiple client environments. The incident highlights the ongoing challenge of securing remote access tools and the need for constant vigilance against evolving cyber threats that exploit both technical flaws and human curiosity.
What's Next?
Huntress advises MSPs to immediately upgrade all ScreenConnect host clients to version 26.6.5 or later and to check for and delete any fake sessions. Organizations should also restrict installer and web access, keep Access installer links private, and rebuild leaked installers to limit unauthorized enrollment. Technicians are urged to avoid joining sessions they cannot verify as legitimate, especially those with crypto-exchange names or blank company fields. Furthermore, MSPs should review server databases and logs for new guest sessions from suspicious IPs and monitor technician workstations for unusual process executions. The ongoing nature of this campaign, with attackers revisiting servers daily, necessitates continuous monitoring and proactive security measures to mitigate potential risks.
Beyond the Headlines
This incident underscores a broader trend in cybersecurity where attackers are becoming increasingly sophisticated in their social engineering tactics and their ability to exploit supply chain vulnerabilities. By targeting MSPs, who manage IT infrastructure for numerous clients, attackers can achieve a multiplier effect, potentially compromising a vast network of organizations through a single point of entry. The use of cryptocurrency themes also reflects the current landscape of cybercrime, where financial incentives often drive malicious activities. This situation highlights the critical need for robust security hygiene, not just at the organizational level, but also within the broader ecosystem of service providers. It also raises ethical questions about the design of software that allows for public access to installers without authentication, creating potential avenues for abuse.
