MSP Control Planes Face Two Different Tests: Stop Active Paths Before Restoring Trust
A ScreenConnect campaign shows how a neglected extension can turn remote administration into rapid endpoint access, while N-central’s zero-day response shows why exposure reduction and controlled restoration matter when the management plane itself is in question.
By Lucia Marin · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess human research credentials or firsthand experience.
Key points
- Huntress reported that a ScreenConnect campaign used cloud-hosted management panels and an authentication weakness in certain RMM+ extension versions to reach managed endpoints, then deploy rogue clients and a persistent malware toolkit.
Sources: S1
- N-able took hosted N-central environments offline and issued a hotfix after public zero-day disclosure; the company said hosted servers were upgraded, while on-premises customers were urged to apply the update before restoring internet access.
Sources: S2
- The comparison points to a containment priority: first remove or constrain the management-plane pathway that can issue commands, then investigate downstream devices and credentials rather than treating a software update alone as proof of recovery.
The management plane is the shared dependency
Remote monitoring and management platforms concentrate an unusually consequential capability: a central web console can monitor, administer and maintain customer networks and devices. That concentration is useful to managed service providers and internal IT teams, but it also means a fault in a console, extension or exposed service can become a route into many downstream environments. The recent ScreenConnect activity and the N-central zero-day response are related by that dependency, not because they describe the same intrusion or even the same technical failure.
The ScreenConnect case is the clearer record of realized downstream impact in the material supplied. Huntress reported that attackers used unauthorized access to cloud-hosted panels to run commands on managed endpoints. Its account ties the activity to at least six MSPs, 288 hosts and 48 organizations, with all reported compromised hosts hit within 90 minutes. The attackers deployed rogue ScreenConnect clients and SCKit, which Huntress described as providing persistent backdoor access, session-cookie interception and self-replication capabilities.
Sources: S1
N-central presents a different stage of the same control-plane risk. Publicly disclosed flaws prompted N-able to take hosted environments offline while it prepared remediation, and the company gave on-premises customers temporary offline guidance. N-able later said its hosted servers had been upgraded and returned online. Defused reported probing of the disclosed attack surface, including anonymous agent sessions, configuration retrieval and unauthenticated contact with a remote-control endpoint. Yet the supplied account says N-able had not flagged the flaws as exploited in the wild. Scanning and demonstrated exploit paths should not be rewritten as confirmed compromise.
Sources: S2
What the evidence says about entry points
The ScreenConnect reporting makes the selection problem visible. Huntress attributed the pathway to RMM+, a third-party extension that uses a shared access key to bypass ScreenConnect authentication. In the versions identified, the key could default to blank when an administrator had never configured it. Huntress said many installations it encountered appeared legitimate—often added for a project and left in place. That is important context: an authorized add-on can still become an ungoverned administrative interface after its original purpose has passed.
Sources: S1
The observed telemetry also matters. Huntress said commands reached endpoints within minutes without corresponding login activity, while the reviewed logs instead pointed to RMM+. That does not establish that every deployment of the extension was compromised; ConnectWise explicitly said its presence alone does not establish compromise. But it does establish a practical investigation question for ScreenConnect operators: whether extensions with command-capable APIs remained installed, how their passphrases were configured, and whether their activity accounts for endpoint commands that ordinary console-login records do not explain.
Sources: S1
For N-central, the supplied reporting describes a broader collection of disclosed issue classes, including XXE, OGNL injection, local privilege escalation, stored XSS, SSRF, remote code execution through an upload path traversal, and insecure IPC channels. A researcher demonstrated an unauthenticated XXE-to-RCE chain involving service import, a trusted local session and password reset. N-able’s stated remediation was N-central 2026.4 HF2, which it said addressed critical updates; the article describes patches for some disclosed zero-days, including those termed most critical. That wording leaves an important operational limit: do not assume from this packet alone that every possible disclosed issue, version or deployment condition has identical coverage.
Sources: S2
Containment is a sequence, not a patch status
Reported fact: ConnectWise disabled five RMM+-family extensions across approximately 400 ScreenConnect environments, and both ConnectWise and Huntress advised organizations to disable the extensions in on-premises deployments. N-able’s response similarly used service interruption as a security control: hosted N-central environments were taken offline, then upgraded, while on-premises customers were directed to upgrade before restoring normal access. These actions target the management channel before they claim normal operations can resume.
Inference: for an MSP deciding what to do first, the two events support a containment order based on control-plane authority. Remove the known command route or internet exposure; preserve and inspect logs and configurations associated with that route; then scope devices, sessions and administrator access that the platform could have reached. The ScreenConnect campaign justifies treating downstream endpoints as part of the incident because rogue clients and SCKit were deployed through the panel. The N-central evidence justifies treating restoration as conditional because public proof-of-concept material and observed probing made the pre-remediation exposure meaningful, even without a reported exploitation finding.
This is also why inventory quality changes the conclusion. A basic list of platform servers is insufficient if it excludes project-era extensions, whether an extension has an access key, cloud versus on-premises placement, public exposure, remote-control functions, or the set of managed endpoints and technician sessions reachable from a console. In the N-central case, Shadowserver reported that more than 148 servers remained exposed online after reporting 1,338 on the preceding day. Those observations are useful exposure signals, but they do not identify whether any particular server was vulnerable, patched or compromised.
Do not collapse observed harm, probing and capability
The strongest analytical mistake would be to flatten the evidence into a single claim that all RMM exposure equals active intrusion. The ScreenConnect account reports a campaign with affected organizations, hosts, rapid command execution and named payload behavior. It also carries a caveat: Huntress said not all SCKit functionality was observed during incidents, and some was identified through payload analysis. That distinction separates demonstrated behavior from potential capability.
Sources: S1
The N-central account has a separate evidentiary profile: public disclosure, proof-of-concept exploits, vendor hotfixes, temporary service withdrawal and reported probing. It includes a dispute over whether the researcher had used N-able’s established disclosure channels, but that dispute does not alter the operational facts that N-able issued guidance and an update. It also does not prove exploitation. A defensible risk assessment should retain those categories separately, because they drive different communications, forensic scopes and recovery thresholds.
Sources: S2
What would change the assessment
The immediate watch items are concrete. For ScreenConnect, organizations need to determine whether the identified extensions existed, whether vulnerable RMM+ versions had a blank access key, whether logs show the extension-associated command pattern, and whether indicators released by Huntress or ConnectWise appear in their environment. For N-central, the key questions are the installed version, whether the hotfix guidance was completed before restored exposure, and whether logs show the probing paths Defused described. These checks follow directly from the supplied reporting; they are not proof that compromise occurred.
The larger lesson is not that remote management must be abandoned. It is that a platform’s convenience rests on an administrative trust boundary that can be widened by extensions, internet exposure and delayed configuration hygiene. Evidence that would materially raise the N-central assessment would include verified exploitation or customer compromise tied to the disclosed flaws. Evidence that would narrow the ScreenConnect assessment would include environment-specific confirmation that the affected extension was absent or correctly configured, alongside no matching indicators or anomalous command activity. Until then, containment should be governed by what the control plane could authorize, while conclusions about compromise remain tied to what the records actually show.
Why it matters
For MSPs, the central operational question is not simply whether a vendor has issued a fix. It is whether a command-capable control plane, its extensions and its reachable endpoints have been contained and then validated with the right evidence. The ScreenConnect campaign demonstrates the downstream consequence of a compromised management path; N-central demonstrates the disruption required when the management path’s exposure is itself uncertain.
Sources
- Hackers Deploy Malware in Fresh ScreenConnect Campaign — SecurityWeek ·
- N-able releases security hotfixes for zero-day vulnerabilities — BleepingComputer ·