An ongoing campaign is targeting deployments of ConnectWise ScreenConnect, a remote access tool, according to a November 12, 2026 article from The Hacker News. The source does not specify where the incident occurred. The attackers are not exploiting a new vulnerability, but an already patched critical flaw, which shifts the question from the software itself to how well it is kept updated.
Key points
- An active campaign is exploiting an already patched flaw in ConnectWise ScreenConnect, a remote access tool, according to The Hacker News.
- The exploited flaw, CVE-2026-84869, is rated 9.9 out of 10 on the CVSS severity scale, a critical level.
- A provider’s remote support sessions can serve as a pathway to its clients.
What we know about the incident
According to a November 12, 2026 article from The Hacker News, an active campaign targeting ConnectWise ScreenConnect is exploiting an already patched critical flaw. The source does not specify where the incident occurred, or in which country. The affected sector is managed IT service providers and their clients.
Blackpoint Cyber, whose Adversary Pursuit Group shared the details with The Hacker News, states that the recovered toolkit exploits CVE-2026-84869. The article’s headline describes ScreenConnect support sessions as potential attack paths into managed service providers.
The available information does not name any affected organization and does not put a figure on any damage. Nothing establishes a link to Quebec or Canada either. We leave it there: the scenario is documented, its geographic scope is not, and it remains instructive here.
What this means for a Canadian SMB
A business does not need to use this particular software to be affected. As soon as an outside provider opens remote access sessions on your machines, its tool becomes a door into your network. Checking that this tool is up to date is as much in your interest as in theirs.
This type of tool is used for technical support: a technician takes control of a workstation without traveling on-site. To work, it relies on the permissions it has been granted, sometimes broad, sometimes limited to specific machines or to sessions authorized case by case; at a provider, a single console is often connected to several clients at once. When a flaw in this type of tool goes unpatched, an attacker can target the tool itself rather than each company one by one.
The fact that a patch already exists is the useful part of this story. Known, patched vulnerabilities continue to be exploited: CISA maintains a public catalog of vulnerabilities with confirmed exploitation. The Canadian Centre for Cyber Security also lists software updates among its baseline controls for small and medium organizations.
Checks to make this week
None of these checks require any special tool or technical skill. They amount to a few emails and a frank conversation with your IT provider. Start by finding out who can connect remotely to your computers, and with what software.
Ask your IT provider, by email, which remote access tool it uses on your systems and when it was last updated. Have them confirm that access to their administration console requires two-factor authentication. On the management side, list the providers that have access to your systems and have any whose contract has ended removed. Agree with your accounting team that no request to change banking details received during a technical support session is processed without a callback to a known number.
There is no absolute protection, and no provider can guarantee zero risk. Knowing who holds the keys to your remote access, however, significantly reduces your exposure to this type of campaign.
FAQ
Our IT provider connects remotely to our computers: what is the risk?
This way of working is normal and useful. The risk lies in the scope of the permissions granted: depending on the configuration, whoever controls the tool can act on the machines that tool has access to. So ask your provider how it protects its own console, who on its team has access to it, and how that access is removed when an employee leaves. A serious provider will answer without taking offense.
How can we tell if the remote access software used in our organization is up to date?
You do not need to check this yourself. Ask the person responsible, whether internal or external, in writing, and request a dated answer. If the tool is hosted by the provider, have them specify who, under the contract, applies the patches; hosting alone does not guarantee this. If it is installed on your own servers, ask who is responsible for it and how often. Keep the answer: it will serve as the starting point for your next follow-up.
Are we too small for an attacker to target us?
No, and this type of campaign illustrates that well. An attacker does not choose your company based on its revenue; it looks for a widely deployed tool that is poorly maintained. Going through a provider that serves several clients gives it leverage, regardless of the size of those clients. Size offers less protection than the discipline of your access management.
Sources
- The Hacker News · press, November 12, 2026
- Canadian Centre for Cyber Security: Baseline Cyber Security Controls for Small and Medium Organizations · baseline control list
- CISA, Known Exploited Vulnerabilities Catalog · vulnerabilities with confirmed exploitation
Source: The Hacker News · https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html
Article prepared by RISS Canada’s monitoring team based on the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
