Morning Threat Brief: Attackers hijack ScreenConnect panels to hit 288 endpoints, a new N-central zero-day beats the emergency patch, police seize StealC servers, and Citrix patches 10 critical flaws

Good morning. Attackers took over cloud-hosted ScreenConnect panels and pushed rogue remote-access clients to 288 endpoints across 48 organizations in about 90 minutes, and the likely way in was a blank password in a third-party extension. The N-central story got worse overnight: a second exploit chain works on servers that already have the emergency patch, and miners moved in within hours. Police seized the servers behind the StealC, Gootloader, and CastleRAT malware operations. And Citrix patched 10 critical NetScaler flaws, including one that needs no login at all. If you run ScreenConnect or N-central, check them first thing today.

1. Attackers hijacked ScreenConnect panels and pushed malware to 288 endpoints in 90 minutes. On November 11, security firm Huntress saw an operator use access to multiple cloud-hosted ConnectWise ScreenConnect panels to push commands to groups of managed endpoints. The commands installed attacker-controlled ScreenConnect clients and a toolkit called SCKit. At least 288 hosts across 48 organizations were hit, all within about 90 minutes. SCKit steals browser and ScreenConnect session tokens and can spread through ScreenConnect sessions, so it can reach a technician's own machine and then every device that technician connects to. ConnectWise published an advisory the same evening and disabled five third-party extensions across about 400 partner environments: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. The leading theory is a flaw in RMM+ versions 1.0.31 and 1.0.32, which accepted a blank access key when an administrator had never set one, bypassing user accounts, roles, and multi-factor authentication. ConnectWise says it found no evidence its own infrastructure was compromised and no flaw in ScreenConnect itself, and the initial access method is still not confirmed. If you run ScreenConnect on premises, disable those five extensions yourself now, update every technician client to 26.6.5 or later, and do not connect to a suspect machine through ScreenConnect until you have checked it, because the session can carry the malware to your workstation.

2. A second N-central exploit chain beats the emergency patch, and miners moved in within hours. Researcher Sean Bales published proof-of-concept code on November 12 for 4EverAble2Shell, a new N-central exploit chain, and a companion set called Agent2Shell that targets managed Windows endpoints. 4EverAble2Shell chains CVE-2026-90436, a critical flaw in the end-of-life Apache Axis 1.x engine scored 9.8, with a privilege escalation inside N-central, giving an unauthenticated attacker remote code execution as root on the server. It works against servers already running the emergency patch, N-central 2026.4 HF2, and it needs the Legacy API enabled and exposed to the internet. Attackers moved fast: researchers report at least 21 servers compromised within hours of the code going public, most of them already on HF2, with the XMRig Monero miner installed. Agent2Shell chains about a dozen flaws to run commands as SYSTEM on managed Windows agents, though no exploitation of it has been reported. N-able restricted the Legacy API and Intune integration, and said on November 13 it found additional indicators of compromise. There is no fix for this chain yet. Disable the Legacy API now, take the server off the internet if you cannot, and hunt for the miner: look for the Java process on the server spawning a shell or curl, unexpected downloads of a shell script, and XMRig activity.

3. Police seized the servers behind StealC, Gootloader, and CastleRAT. Law enforcement disrupted the infrastructure behind three major malware operations as part of Operation Endgame, seizing 235 servers and 257 domains and recovering 6.4 million victim credentials. Gootloader is the malware that spreads through poisoned search results and compromised websites, StealC is the information stealer sold to other criminals, and CastleRAT is the remote access tool that gives attackers control of infected machines. Authorities have taken StealC servers down before this year, so expect the operators to try to rebuild, but the takedown disrupts active campaigns and cuts off command servers that infected machines phone home to. Stolen credentials do not expire with the servers. If your credentials were ever caught by an infostealer, assume they are in that pile: change the passwords, turn on multi-factor authentication everywhere it is offered, and check Have I Been Pwned for your work and personal email addresses.

4. Citrix patched 10 critical NetScaler flaws, including one that needs no login. Citrix published patches on November 12 for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical memory flaws, plus a critical authentication bypass in NetScaler Console. The worst, CVE-2026-107412, scores 9.5 and can cause memory corruption on Gateway and AAA virtual servers. CVE-2026-120868, scored 9.3, sits in core packet processing and affects every NetScaler ADC and Gateway deployment, including the default configuration. The NetScaler Console flaw, CVE-2026-120869, scores 9.4 and lets an unauthenticated attacker bypass authentication controls and reach restricted resources. Citrix says it is not aware of any exploitation of these flaws, and no public proof of concept has been confirmed. NetScaler flaws have been exploited quickly in the past: CISA added six NetScaler CVEs to its exploited list between March and October this year. Update NetScaler ADC and Gateway to 14.1-73.57 or 13.1-64.39 and later, and NetScaler Console to 14.1-74.34.

Warning: two exploited flaws hit their fix deadline today, Friday, November 13: the two Barracuda Email Security Gateway flaws that chain to root, and the second Ivanti flaw CVE-2026-118527. The GPUStack flaw CVE-2026-102895 was due yesterday, Thursday, November 12, and SANS honeypots are already seeing exploit attempts against it, so treat any unpatched GPUStack install as exposed. The Apple KEV entry CVE-2024-27834 is due Wednesday, November 18, the SonicWall SSL-VPN flaw CVE-2026-19868 is due Friday, November 20, and the four new KEV entries from November 10, including the Outlook and Chrome zero-days, are due Tuesday, November 24.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

No new CISA KEV entries today. The catalog stands at 1,779 entries, last updated November 10.

← kevintswaney.com