Morocco cyberattack alert

Morocco’s General Directorate for Information Systems Security warned of a critical cyberattack campaign targeting the cloud administration panels of ConnectWise ScreenConnect and managed service providers. Attackers took control of the panels of at least six providers and sent commands to 288 computers across 48 organizations in less than 90 minutes. The attackers exploited the “Run Command” feature to deploy a malicious version of the software and the “SCKit” tool, aiming to establish persistent access, disable security tools, and impede incident response. The initial access method and the scope of the incident remain under investigation, and no evidence has been found of a compromise of ConnectWise’s infrastructure or a vulnerability in ScreenConnect itself. The directorate recommended disabling the five RMM+ add-ons and not re-enabling them; revoking active sessions and tokens; changing passwords; reviewing logs and systems; and isolating any suspicious systems. It also urged organizations to verify that patches for vulnerabilities CVE-2026-3564 and CVE-2026-84869 have been applied to on-premises systems exposed to the internet.

Size: 120%Text Size

Notice: This Is an AI-Generated Summary

Display The Full Article