[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

vendor incident notice (Huntress, Nov 11-12, 2026); indicators from Huntress

Hunt: rogue ScreenConnect clients, the TrapWatch task and RelayTrap files from the Nov 11 MSP campaign

  • Network (block and search): 185.99.255[.]28 (attacker ScreenConnect server and installer), relays newnewnew.gotdns[.]org and soxnewwork.homedns[.]org, second server sc.payproofkit[.]com / 155.94.150[.]39, toolkit host ns.mo7sen[.]dev.
  • Rogue client IDs: 2588ef5c15954b10, ed630cc2c873b091. Any ScreenConnect client service whose instance ID isn't yours is suspect; most hosts should have exactly one.
  • Persistence: scheduled task TrapWatch running as SYSTEM every 10 seconds.
  • Files: C:\ProgramData\RelayTrap\ (trap component and logs), C:\Windows\Temp\sckit-* (stager). BleepingComputer also lists Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe, Run-Lateral-Full.bat, installer URLs containing &c=Exploited and an operator name Addmin.
  • Process lineage: the legitimate ScreenConnect client spawning msiexec, PowerShell or schtasks around 17:48 UTC Nov 11 onward.
  • Technician side: treat any technician workstation that connected to an affected host as compromised; check for the same task and paths and for stolen browser sessions.

Sources: Huntress Support: 2026 - November - ScreenConnect (indicators and response steps) · ConnectWise Trust Center advisory: ScreenConnect precautionary extension disabling and partner guidance (Nov 11, 2026, 22:45 UTC) · BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations (Nov 11, 2026)